skills.rest
grzmol
grzmolCOMMUNITY
Explore all skills by this author →
GitHub

sf-org-security-audit

Audits Salesforce org permissions, sharing, code exposure, and secrets into a severity-ranked findings report.

2|Updated Sep 12, 2026
Search Tags:#permissions#compliance#security audit#salesforce#soql#secrets detection#sharing model
One-click install
npx skills add https://github.com/grzmol/vibe-force --skill sf-org-security-audit-grzmol
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sf-org-security-audit
Source: https://github.com/grzmol/vibe-force/tree/main/skills/sf-org-security-audit
Command: npx skills add https://github.com/grzmol/vibe-force --skill sf-org-security-audit-grzmol

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Salesforce orgs accumulate invisible security exposure over time: broad ModifyAllData grants, sprawling profiles, guest user access, without-sharing Apex, and secrets buried in source or git history. Manually checking every layer is slow and error-prone, and no single CLI command covers the Setup-only controls. ## Core Features & Use Cases - Grant and access-matrix audit: Queries PermissionSetAssignment, ObjectPermissions, and FieldPermissions to find who holds ModifyAllData, ViewAllData, AuthorApex, and object-level sharing bypasses. - Code and public surface review: Inventories @AuraEnabled, @RestResource, without sharing classes, guest user and Experience Cloud exposure, Named Credentials, and secrets in source and git history. - Severity-ranked report: Produces a findings report with evidence (query results, file:line, Setup pages) and a fix per item, stored in .vibeforce/reports for diffing across runs. - Use Case: When onboarding an unfamiliar org or preparing for a customer security review, run the audit to get a complete, evidence-backed posture report covering identity, grants, record access, integrations, and the Setup-only layer. ## Quick Start Ask the assistant to run a standing security audit of the Salesforce org aliased vf-prod and produce a severity-ranked findings report.

Frequently Asked Questions about sf-org-security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit who has Modify All Data in Salesforce?▼

Query PermissionSetAssignment filtered on PermissionSet.PermissionsModifyAllData = true using sf data query. The audit repeats this for ViewAllData, AuthorApex, and ViewEncryptedData, then flags integration accounts or non-admin users holding these grants as high-severity findings.

How to check Salesforce org security posture before a review?▼

Run a layered audit covering identity, administrative grants, object and field access, record sharing, code exposure, public surface, integrations, and Setup-only settings like Health Check and MFA. Each finding gets a severity, evidence, and a fix in a written report.

Is it safe to run a security audit against a production Salesforce org?▼

Yes, this audit is read-only: it uses sf data query, retrieve preview, and grep, and never changes a permission, setting, or record. Retrieved metadata goes into a scratch output directory so the working tree stays untouched.

Why is reading retrieved profile XML not enough for a permission audit?▼

Profiles retrieve as sparse representations, so a permission missing from the XML is not proof it is not granted. Confirm grants with ObjectPermissions, FieldPermissions, and PermissionSetAssignment SOQL queries instead.

What is the difference between this audit and a code security review?▼

This audit measures the standing posture of the whole org: grants, sharing, guest access, and Setup settings. Reviewing the security of a specific diff belongs to a per-diff reviewer, and writing enforcing Apex belongs to a security-model skill.

Can Salesforce Health Check and session settings be audited via CLI?▼

Not reliably; these belong to a Setup-only layer that a person records manually, including Health Check score, session settings, password policy, MFA, and Setup Audit Trail. The audit includes them in the report with the same severity scale.

Related Skills

Explore More Software Engineering Skills→
takusaotometakusaotome
5

salesforce-cli-expert

Generate Salesforce CLI commands for authentication, SOQL queries, metadata retrieval, and deployments.

Community
Intermediate
NiravenNiraven

api-credentials-hygiene

Audit git history for exposed API keys and verify file permissions.

Community
Intermediate
personamanagmentlayerpersonamanagmentlayer
41

codeql-expert

Guide CodeQL static analysis, custom queries, and CI/CD integration.

Official
Advanced
koderoverkoderover
7

grafana

Query Grafana metrics, manage dashboards, and configure alert rules via API.

Official
Intermediate