forcedotcom/sf-skills dx-org-analyze
Checked the catalogued skill at dx-org-analyze.
A set by no findings on this axis
A set by no findings on this axis
B; retained sample includes a medium finding · SD-007 · what this rule accepts as a false positive →
35 suppressed by AI triage
Shows an example command using an absolute path for illustration, not executed code.
Documents example output directory, not runtime behavior.
Illustrates command usage with absolute paths in documentation.
Part of example command; no execution risk.
Shows example output path; purely illustrative.
Documentation of usage, not code that writes outside its directory.
Example output path in docs; no actual file manipulation occurs.
Uses absolute /tmp path for temporary files, which is a safe and intended design.
Writes to /tmp directory for temporary output, not traversing outside intended scope.
Temporary file paths are confined to /tmp, no directory traversal present.
Absolute /tmp usage is benign; no ../ components.
Script writes temporary files to /tmp, a permitted location.
Copying temporary files from /tmp to a user-provided or safe default output, no traversal.
File operations stay within /tmp and a controlled output directory.
Collects data to a /tmp directory, which is expected for temporary storage.
Runs scripts using /tmp paths, no path traversal.
No traversal; uses /tmp for temporary output.
Copies temporary analysis results from /tmp, safe operation.
Copying files from /tmp to a controlled output directory, no traversal.
The path /tmp/org-data is only shown in documentation as an example output location and does not represent executable code.
The path /tmp/org-data/ appears only as a documentation example of expected output structure and is not used by code.
The path /tmp/source is shown only as a usage example in documentation, not actual code execution.
The path /tmp/target is a sample argument in documentation, not a real operation.
The path /tmp/org-diff is used only as an example output location in documentation.
The code performs a normal outbound request to the Salesforce API for data collection, not malicious exfiltration.
The outbound request uses the official Salesforce REST API with an access token, intended for legitimate data retrieval.
The network call is part of a routine REST API call for authorized org data access, not a malicious payload download.
Absolute path used only in usage example, not in code.
Absolute path used only in usage example, not in code.
Absolute path appears only in a usage comment; no code reads or writes to that location.
Absolute path appears only in a usage comment; no code reads or writes to that location.
The finding only declares a base_url in configuration, not an actual outbound call or permission grant.
The relative path is hard‑coded to an internal script and not derived from external input, so it does not pose a security threat.
Uses relative traversal to locate skill files within the repo, not arbitrary user input.
Specifies scripts directory relative to script location, harmless within the project structure.