plugin

salesforce-code-quality High risk

Name: salesforce-code-quality
Author: forcedotcom

forcedotcomforcedotcom/sf-skillsupdated 2 days ago

Analyze and govern Salesforce code quality with Salesforce Code Analyzer and the Well-Architected framework: set up and troubleshoot Code Analyzer, run security/performance/best-practice/style scans across engines (PMD, ESLint, CPD, RetireJS, Flow, SFGE, ApexGuru), author custom Regex/PMD/ESLint rules, and run a multi-pillar Well-Architected architecture review with file:line evidence. Use for static analysis, code scanning, quality gates, custom lint rules, or a holistic architecture/Well-Architected audit, includes a read-only architecture-review agent.

forcedotcom's own description, from the plugin's files.

Engineering Sales & marketing Data & analyticsplugin

Stars: 1,140
Version: v1
Copies: 0

Overview Security11 Versions1 Files72

Overview

blockHigh risk

Waxell rates it high risk: 11 findings, highest severity critical.

Highest severity: critical
Findings: 11
What ran: Static analysis

A clean result means nothing alarming in what is published, not a guarantee. How the checks work

Skills in this plugin

dx-code-analyzer-configureforcedotcomSet up, configure, and troubleshoot Salesforce Code Analyzer for any project. Handles installation, prerequisite checks, diagnosing broken… High riskEngineeringSales & marketing1.1k

We don't republish the plugin's instructions. Read them on GitHub at the reviewed commit.

Security

Security scan

Checked 2 days ago

Result

High risk Waxell rates it high risk: 11 findings, highest severity critical.

Checked with static analysis: servers it launches, packages it installs at runtime, scripts piped to a shell and bundled binaries. Nothing was run. How the checks work

Findings (11)

critical · 2

critical
Tells Claude to download a script and pipe it to a shell
skills/dx-code-analyzer-configure/references/engine-prerequisites.md:90 · skill_risk:S1
critical
Tells Claude to download a script and pipe it to a shell
skills/dx-code-analyzer-configure/references/engine-prerequisites.md:146 · skill_risk:S1

high · 9

high
Tells Claude to install unpinned packages (@salesforce/cli)
skills/dx-code-analyzer-configure/SKILL.md:204 · skill_risk:S2
high
Tells Claude to install unpinned packages (@salesforce/cli)
skills/dx-code-analyzer-configure/examples/ci-github-actions.yml:59 · skill_risk:S2
high
Tells Claude to install unpinned packages (@salesforce/cli@latest)
skills/dx-code-analyzer-configure/references/ci-cd-templates.md:67 · skill_risk:S2
high
Tells Claude to install unpinned packages (@salesforce/cli)
skills/dx-code-analyzer-configure/references/diagnostic-flow.md:23 · skill_risk:S2
high
Tells Claude to install unpinned packages (@salesforce/cli)
skills/dx-code-analyzer-configure/references/engine-prerequisites.md:29 · skill_risk:S2
high
Tells Claude to install unpinned packages (@salesforce/cli)
skills/dx-code-analyzer-configure/references/troubleshooting.md:13 · skill_risk:S2
high
Tells Claude to install unpinned packages (@salesforce/cli)
skills/dx-code-analyzer-configure/scripts/check-prerequisites.sh:37 · skill_risk:S2
high
Tells Claude to install unpinned packages (eslint-plugin-my-custom)
skills/dx-code-analyzer-custom-rule-create/references/eslint-custom-plugins.md:44 · skill_risk:S2
high
Tells Claude to install unpinned packages (@salesforce/cli)
skills/dx-code-analyzer-run/references/error-handling.md:9 · skill_risk:S2

Versions

Version history

Each distinct content we have seen, newest first, with the verdict it got at the time.

One version so far: v1 (0.2.0), seen 2026-11-03.

Files

72 files, 427 KB in total. Names only; open them on GitHub.

.claude-plugin/plugin.json
.codex-plugin/plugin.json
CHANGELOG.md
agents/architecture-review.md
scripts/test/test_verify_public_plugin_release.py
scripts/verify-public-plugin-release.py
skills/dx-code-analyzer-configure/SKILL.md
skills/dx-code-analyzer-configure/examples/apex-project-config.yml
skills/dx-code-analyzer-configure/examples/ci-github-actions.yml
skills/dx-code-analyzer-configure/examples/fullstack-project-config.yml
skills/dx-code-analyzer-configure/examples/lwc-project-config.yml
skills/dx-code-analyzer-configure/references/ci-cd-templates.md
skills/dx-code-analyzer-configure/references/config-schema.md
skills/dx-code-analyzer-configure/references/diagnostic-flow.md
skills/dx-code-analyzer-configure/references/engine-prerequisites.md
skills/dx-code-analyzer-configure/references/rule-name-resolution.md
skills/dx-code-analyzer-configure/references/troubleshooting.md
skills/dx-code-analyzer-configure/scripts/check-prerequisites.sh
skills/dx-code-analyzer-configure/scripts/generate-config.sh
skills/dx-code-analyzer-configure/scripts/validate-config.sh
skills/dx-code-analyzer-custom-rule-create/SKILL.md
skills/dx-code-analyzer-custom-rule-create/assets/pmd-ruleset-template.xml
skills/dx-code-analyzer-custom-rule-create/examples/metadata-xml-example-fields-api.md
skills/dx-code-analyzer-custom-rule-create/examples/metadata-xml-example-flows.md
skills/dx-code-analyzer-custom-rule-create/examples/metadata-xml-example-permissions.md
skills/dx-code-analyzer-custom-rule-create/examples/metadata-xml-examples.md
skills/dx-code-analyzer-custom-rule-create/examples/regex-examples.md
skills/dx-code-analyzer-custom-rule-create/examples/xpath-examples.md
skills/dx-code-analyzer-custom-rule-create/references/advanced-pmd-patterns.md
skills/dx-code-analyzer-custom-rule-create/references/apex-ast-reference.md
skills/dx-code-analyzer-custom-rule-create/references/eslint-custom-plugins.md
skills/dx-code-analyzer-custom-rule-create/references/eslint-rules-discovery.md
skills/dx-code-analyzer-custom-rule-create/references/eslint-tier2-configurable.md
skills/dx-code-analyzer-custom-rule-create/references/eslint-tier3-custom-plugins.md
skills/dx-code-analyzer-custom-rule-create/references/metadata-xml-rules.md
skills/dx-code-analyzer-custom-rule-create/references/regex-rule-schema.md
skills/dx-code-analyzer-custom-rule-create/references/troubleshooting.md
skills/dx-code-analyzer-custom-rule-create/references/xpath-patterns-governor-limits.md
skills/dx-code-analyzer-custom-rule-create/references/xpath-patterns-method-calls.md
skills/dx-code-analyzer-custom-rule-create/references/xpath-patterns-security.md
skills/dx-code-analyzer-custom-rule-create/references/xpath-patterns-structure.md
skills/dx-code-analyzer-custom-rule-create/references/xpath-patterns.md
skills/dx-code-analyzer-custom-rule-create/scripts/create-pmd-rule.js
skills/dx-code-analyzer-custom-rule-create/scripts/create-regex-rule.js
skills/dx-code-analyzer-run/SKILL.md
skills/dx-code-analyzer-run/examples/README.md
skills/dx-code-analyzer-run/examples/basic-scan-output.json
skills/dx-code-analyzer-run/examples/command-variations.md
skills/dx-code-analyzer-run/examples/fix-application-before-after.md
skills/dx-code-analyzer-run/examples/large-scan-output.json
skills/dx-code-analyzer-run/examples/security-focused-output.json
skills/dx-code-analyzer-run/references/command-examples.md
skills/dx-code-analyzer-run/references/engine-reference.md
skills/dx-code-analyzer-run/references/error-handling.md
skills/dx-code-analyzer-run/references/flag-reference.md
skills/dx-code-analyzer-run/references/post-scan-workflows.md
skills/dx-code-analyzer-run/references/quick-start.md
skills/dx-code-analyzer-run/references/special-behaviors.md
skills/dx-code-analyzer-run/references/vendor-file-handling.md
skills/dx-code-analyzer-run/scripts/apply-fixes.js
skills/dx-code-analyzer-run/scripts/describe-rule.js
skills/dx-code-analyzer-run/scripts/discover-fixes.js
skills/dx-code-analyzer-run/scripts/filter-violations.js
skills/dx-code-analyzer-run/scripts/list-rules.js
skills/dx-code-analyzer-run/scripts/parse-results.js
skills/dx-code-analyzer-run/scripts/query-results.js
skills/dx-code-analyzer-run/scripts/summarize-fixes.js
skills/dx-code-analyzer-run/scripts/verify-execution.sh
skills/platform-architecture-analyze/SKILL.md
skills/platform-architecture-analyze/references/manual-review-checklist.md
skills/platform-architecture-analyze/references/observable-checks.md
skills/platform-architecture-analyze/references/well-architected-rubric.md

See and control which skills your people use

Inside your organization, Waxell scans each skill and plugin before anyone installs it, approves what passes and publishes it to a private marketplace, and puts every MCP tool call behind one governed URL.

Book a demo

30 minutes. No commitment.

SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF

More engineering skills and plugins

See all