forcedotcom/sf-skills service-agentforce-channel-configure
Checked the catalogued skill at service-agentforce-channel-configure.
C; retained sample includes a medium finding · SD-008 · what this rule accepts as a false positive →
A set by no findings on this axis
B; retained sample includes a medium finding · SD-007 · what this rule accepts as a false positive →
17 suppressed by AI triage
The referenced endpoint is Salesforce's own SOAP API, a legitimate internal service.
The endpoint is a Salesforce metadata namespace reference, not an executed outbound call.
The entry merely declares the Salesforce Metadata API endpoint for package deployment, not an active outbound call or permission grant.
The file is a documentation snippet with no executable code; the flagged base64 string is likely part of documentation or absent in this context.
The base64 string is part of a documentation example, not code that executes it.
Base64 content is shown as part of documentation, not executed.
The flagged base64 likely represents an embedded template snippet in docs.
Same as above; documentation context, no execution.
Base64 string appears in a descriptive section of the file.
Absolute path is used for temporary build directories, not to escape sandbox.
Path refers to a temporary working directory inside the project.
Same temporary path usage as previous findings.
Base64 content is part of documentation, not executed.
Base64 string appears in a comment block describing XML templates.
Temporary directory path used for package generation, not malicious.
Static XML namespace string, not an outbound network call or permission grant
The URL is only used as an XML namespace string for parsing, not an outbound network request.