Help us improve
Share bugs, ideas, or general feedback.
From vanguard-frontier-agentic
Executes read-only SOQL queries against a connected Salesforce org via sf data query CLI under T1 least-privilege scope. Returns sanitized JSON with structured audit envelope. Use for live record evidence like pipeline counts, field values, or aggregate queries.
npx claudepluginhub raishin/vanguard-frontier-agentic --plugin vanguard-frontier-agenticHow this skill is triggered — by the user, by Claude, or both
Slash command
/vanguard-frontier-agentic:salesforce-soql-explorer-skillThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Read-only live SOQL execution against a connected Salesforce org under T1
Generates production-ready SOQL queries from natural-language requirements with selectivity analysis and governor-limit guidance. Does not execute queries.
Identifies Salesforce pitfalls like SOQL N+1 queries, governor limit violations, API overuse, and SOQL injection during code reviews, onboarding, and integration audits.
Guides technical evaluation of code review feedback: read fully, restate for understanding, verify against codebase, respond with reasoning or pushback before implementing.
Share bugs, ideas, or general feedback.
Read-only live SOQL execution against a connected Salesforce org under T1 least-privilege scope. This skill is a flashlight, not a filing cabinet. It queries evidence; it does not write, deploy, or mutate anything.
Use salesforce-soql-explorer-skill when the work requires live record evidence
from a connected org:
Delegate elsewhere when:
| Situation | Skill to use |
|---|---|
| User pastes metadata XML or deployment export for review | salesforce-metadata-review-skill |
| Schema or field definitions needed without record values | salesforce-metadata-fetcher-skill |
| Request requires INSERT, UPDATE, DELETE, MERGE, or UPSERT | T3 — requires human approval via salesforce-live-guard-agent |
| Large-volume export (> 2,000 records) or scheduled batch | salesforce-bulk-data-ops-skill |
Static code review of a .soql file or Apex selector | querying-soql (sf-skills) |
| A change proposal emerges from findings | Escalate to salesforce-live-guard-agent |
| Permission topology findings surface | Hand off to salesforce-permission-model-review-skill |
Before executing any query, confirm:
--target-org value recognized by sf org list.
Never accept a raw instance URL or session token.Account, Opportunity,
My_Custom_Object__c).If any of these are missing, ask before proceeding.
sf org display --target-org <alias>
Verify: org type (production vs. sandbox), username, instance URL, OAuth Connected App. If the org type is production and the Connected App allowlist does not explicitly authorize this alias, stop (see Stop Conditions).
sf sobject describe --sobject <SObjectName> --target-org <alias>
Confirm: the sObject exists, the Run As account has Read access, and the requested fields are accessible (not restricted by FLS). If any field is encrypted (Shield PE / PMLE), remove it from the query and note the redaction.
Apply these constraints:
SELECT *sf data query \
--query "SELECT <fields> FROM <SObject> WHERE <filter> LIMIT 5" \
--target-org <alias> \
--result-format json
Inspect output for: unexpected fields, encrypted placeholders, PII exposure, schema surprises. Confirm the shape matches the intent before expanding volume.
sf data query \
--query "SELECT <fields> FROM <SObject> WHERE <filter> LIMIT <n>" \
--target-org <alias> \
--result-format json
Maximum interactive LIMIT: 2,000. For larger volumes, decline and route to
salesforce-bulk-data-ops-skill.
Apply redaction rules before emitting any output:
<org_id_placeholder> or
<record_id_placeholder> as appropriate.<user_id_placeholder>.Use jq for structured redaction:
sf data query \
--query "SELECT Id, Name FROM Account LIMIT 5" \
--target-org <alias> \
--result-format json \
| jq '.result.records[] | {Id: "<record_id_placeholder>", Name: .Name}'
Every execution must produce a structured audit envelope (see Audit Envelope Schema below). Do not omit the envelope even if results are empty.
If query results surface access anomalies, unexpected field values, or policy violations, hand off to the appropriate review skill with the sanitized results and the audit envelope as the input payload. Do not escalate raw unsanitized output.
Score the query design and execution quality before emitting results. Threshold: 80+ acceptable, 60–79 emit with caveat, below 60 reject and request revision.
| Dimension | Points | What earns full marks |
|---|---|---|
| Selectivity | 30 | WHERE clause uses at least one indexed field; no full table scans on objects > 10k records |
| Field minimality | 20 | Only required fields enumerated; no SELECT *; no encrypted fields included |
| Governor limit awareness | 20 | LIMIT applied and appropriate to volume; no queries likely to exceed 50k row limit; aggregate used when count is the goal |
| Redaction quality | 15 | All Salesforce IDs, user IDs, PII fields redacted per rules; audit envelope populated |
| Audit envelope completeness | 15 | All required audit fields present; query text hash computed; timestamp accurate |
Scoring penalties:
This skill operates exclusively at T1 — read-only runtime. The contract is:
api and refresh_token only. No full, web,
sfap_api, cdp_query_api, or any other scope.sf org list that the target alias
is in the authorized set before executing any query.Stop immediately and do not execute if:
INSERT, UPDATE, DELETE,
MERGE, UPSERT (case-insensitive).describe output: encrypted: true).View Setup and Configuration
permission (verify via sf org display output).Every execution emits an audit envelope. The envelope travels with the sanitized output to any downstream review skill.
audit_envelope:
matter_id: "<caller-provided-or-generated-uuid>"
skill_id: "salesforce-soql-explorer-skill"
skill_version: "0.1.0"
target_org_alias: "<alias>" # never the raw org ID
run_as_user_id: "<user_id_placeholder>" # placeholder; never real ID in output
query_text_hash: "<sha256-of-query>" # hash only if PII risk; else include query
query_text: "<soql-string-or-redacted>" # omit if PII risk; include hash instead
record_count: <integer>
redactions_applied:
- field: "<FieldApiName>"
reason: "<pii|encrypted|org_id|user_id>"
timestamp: "<ISO-8601-UTC>"
org_type_verified: "sandbox | production"
governor_limit_headroom: "<estimated-rows-vs-limit>"
verdict: "acceptable | caveat | reject"
quality_score: <0-100>
quality_notes: "<what drove the score>"
records:
- <sanitized record objects>
metadata:
record_count: <integer>
sObject: "<SObjectApiName>"
fields_queried: ["<field1>", "<field2>"]
fls_notes: "<any FLS restrictions observed>"
fields_skipped_encrypted: ["<field>"] # if any
audit_envelope:
<see Audit Envelope Schema>
escalation_triggers_fired:
- "<trigger name or 'none'>"
missing_evidence:
- "<what would strengthen the query or findings>"
assumptions:
- "<explicit list of assumptions made>"
Apply in order. Do not bypass for any reason.
00D): Replace with
<org_id_placeholder>.<record_id_placeholder> in output records.<user_id_placeholder>.fields_skipped_encrypted.assumptions.When findings from query results warrant further review, hand off to the appropriate skill with the sanitized output and audit envelope as the payload:
| Finding type | Hand off to |
|---|---|
| Metadata anomalies (field config, object structure) | salesforce-metadata-review-skill |
| Access or permission findings (unexpected record visibility) | salesforce-permission-model-review-skill |
| A change proposal emerges from query evidence | salesforce-live-guard-agent |
| Org posture concern from query results | salesforce-org-assessment-skill |
Required handoff fields: matter_id, audit_envelope, sanitized_records
(summary — not full dump), escalation_triggers_fired, missing_evidence,
assumptions.
Stop and do not continue if:
INSERT, UPDATE, DELETE, MERGE,
UPSERT) — stop, emit a refusal, route to human approval path.encrypted: true in describe output) —
remove fields and warn, or stop if the user insists on including them.View Setup and Configuration — stop and escalate
to org administrator.salesforce-bulk-data-ops-skill.| File | When to read |
|---|---|
references/cli-commands.md | sf CLI query commands, output formats, jq patterns, org introspection |
references/least-privilege-scope.md | Connected App config, Run As profile design, denied permissions, token rotation |
references/safe-query-patterns.md | Safe SOQL patterns, indexing rules, anti-patterns, annotated examples |