forcedotcom/sf-skills service-de-channel-routing-configure
Checked the catalogued skill at service-de-channel-routing-configure.
C; retained sample includes a medium finding · SD-008 · what this rule accepts as a false positive →
A set by no findings on this axis
A set by no findings on this axis
25 suppressed by AI triage
Writes to a fixed /tmp file, no user-controlled path.
Uses a predetermined temporary file, no traversal.
Writes to a constant /tmp file, safe.
Fixed temp path, no traversal risk.
Predefined /tmp file, no user input.
Uses a static temporary path, benign.
No traversal, writes to known /tmp file.
Fixed /tmp location, safe.
Writes to a constant temp file, no risk.
Uses a predetermined /tmp file, safe.
Fixed temporary file path, no traversal.
Writes to known /tmp file, benign.
The reference to /tmp/ccr-asas.json appears only in documentation; it does not pose a real path‑traversal risk.
The /tmp path is used in a documented command; no exploitable input handling is present.
This absolute path is part of a static example, not dynamic user input, so it is not a threat.
Writing to /tmp/ccr-fallback-queues.json in the example is benign and not exploitable.
The text is plain documentation about Salesforce channels, with no executable payload or malicious intent.
The script creates a temporary directory in /tmp for a known use case, not arbitrary path traversal.
Output is written to /tmp/ccr-deploy.json as a temporary file, which is harmless and expected.
The snippet is documentation showing a CLI command that writes to /tmp, not active code.
Same as above; the command writes a JSON file to /tmp in illustrative documentation.
The base64 string is part of explanatory text, not executed; thus no threat.
Documentation writes a JSON file to /tmp, which is harmless in this context.
Example query output redirected to /tmp in documentation, not a malicious action.
The base64 string appears in a documentation example, not in executable code or payloads.