Scanned skills

forcedotcom/sf-skills dx-org-manage

Checked the catalogued skill at dx-org-manage.

SkillTrust corpus scan 7 November 2026 v0.13.0 via skillsh Verify on GitHub
B AI-triaged 11
A Security

A set by no findings on this axis

A Permissions

A set by no findings on this axis

B Transparency

B; retained sample includes a medium finding · SD-007 · what this rule accepts as a false positive →

showing 10 of 11
transparencymedium SD-007
examples/scratch-orgs/list_output.json
transparencymedium SD-007
examples/scratch-orgs/list_output.json
transparencymedium SD-007
examples/scratch-orgs/list_output.json
transparencymedium SD-007
examples/scratch-orgs/list_output.json
transparencymedium SD-007
examples/scratch-orgs/resume_output.json
transparencymedium SD-007
examples/scratch-orgs/resume_output.json
transparencymedium SD-007
examples/scratch-orgs/success_definition_file.json
transparencymedium SD-007
examples/scratch-orgs/success_definition_file.json
transparencymedium SD-007
examples/scratch-orgs/success_shape.json
transparencymedium SD-007
examples/scratch-orgs/success_shape.json
2 suppressed by AI triage
transparencymedium SD-007 benign_example
examples/scratch-orgs/display_output.json

The JSON only lists an instance URL, not an executed network call or permission grant, so it is a benign example.

transparencymedium SD-007 benign_example
examples/scratch-orgs/success_edition.json

The instanceUrl is merely a configuration endpoint for a Salesforce scratch org, with no code executing outbound calls, so it does not represent a real threat.