forcedotcom/sf-skills › external-diagram-mermaid-generate

The '../' reference is used only in a Markdown link to another skill manifest, not in code that reads or writes files.

The '../' path appears solely in a documentation link, not in executable code accessing the file system.

The relative path is part of a markdown table reference, harmless in the skill manifest.

The '../' path is used in a link, not for file I/O, so poses no threat.

The reference to another skill via '../' is safe and intended for documentation purposes.

The '../' traversal appears only in a markdown link, not in executable code, thus not a security risk.

The snippet is example code showing how to obtain a Salesforce OAuth token; it is benign documentation, not malicious execution.

This is illustrative Python code for a legitimate token request, not an actual threat.

It demonstrates a standard API call to Salesforce, purely instructional and harmless.

Documentation example of OAuth device flow, not malicious code

Documentation example of polling token endpoint, not malicious code

Python example of OAuth device flow in documentation, benign

Python example of token polling in documentation, benign

Example curl command used in documentation, not an active threat.

requests.post example is part of documentation, not an active attack.

This is a documentation example of a curl command, not executable code.

The snippet shows a library call in documentation, not an active outbound network operation.

It is a documented example of revoking a token, not a real network request being made by the application.

This is a documentation example explaining usage, not executable code that writes to /tmp.

The absolute path appears only in a textual guide, not in actual code that accesses the filesystem.

The absolute path is shown only as a user example in documentation, not executed code.

The absolute path is used only in README instructions, not in executable code.

The absolute path appears only as a command example in documentation, not as part of runtime logic.

Uses a standard temporary location for a PID file, not a malicious path traversal.

Specifies a diagram file in /tmp, a benign temporary directory.

Defines the PID file in a standard temp directory, not a security risk.

Uses a temporary path for the watched diagram file, a normal practice.

Loads a script from a CDN, which is a common pattern for front‑end libraries.

Prints the local server URL; no external data exfiltration occurs.

Opens a browser to a localhost URL, not a dangerous outbound call.

Retrieves server info from a local PID file, no external communication.

Prints a localhost URL using the default port; no external network activity.