runverdict/sf-security-review-toolkit
Plugin Claude Code
Skills that prepare an ISV partner for the AppExchange/AgentExchange security review end to end — autonomous multi-agent codebase audit, submission-artifact generation, scan orchestration, test-environment runbooks, and an honest readiness verdict.
runverdict/sf-security-review-toolkit
Hook
Runs before the agent uses a tool for Edit, Write and Bash tool calls, executing authz-gate-hook.mjs and sf-ops-gate-hook.mjs via node (2 commands). From runverdict/sf-security-review-toolkit.
runverdict/sf-security-review-toolkit
Skill Claude CodeCodex
Phase 1 of security review prep. Runs the autonomous multi-agent white-box audit of the partner's own codebase across the applicable threat dimensions — find, adversarially verify, synthesize — maintaining a findings ledger that makes every re-run incremental. Use after scope-submission, after fixing findings, or…
runverdict/sf-security-review-toolkit
Skill Claude CodeCodex
The opt-in deep audit of the INSTALLED package, run against the throwaway org it was installed into — the thin dynamic pass that previews what the Salesforce reviewer actually does (install your package, then test it). Verifies the subscriber-effective permission grants (including the install-time UEC grant drop), the…
runverdict/sf-security-review-toolkit
Skill Claude CodeCodex
Install the Salesforce CLI and authenticate the orgs the deployed-org deep audit needs — from a machine that may have no local browser (CI box, remote server, devcontainer). The CLI-gated entry step the autonomous orchestrator invokes only when the operator opts into auditing the deployed package; read-only on the…
runverdict/sf-security-review-toolkit
Skill Claude CodeCodex
Cut a released managed 2GP from the partner's source — ONLY when the deployed-org deep audit finds no released version to audit yet. The common case is the partner already has a release; this is the fallback that produces an installable artifact so the deep audit has something to stand up. It does not modify the…
runverdict/sf-security-review-toolkit
Skill Claude CodeCodex
Phase 5 of security review prep. Inventories every artifact and evidence file against the baseline, fills the required-artifacts checklist (HAVE only with verified evidence), pre-fills the questionnaire with the hard N/A lint, cross-checks answers against artifacts, compiles the readiness tracker, computes the…
runverdict/sf-security-review-toolkit
Skill Claude CodeCodex
Phase 2 of security review prep. Drafts every reviewer-facing submission artifact from the partner's actual code, config, and live server — AuthN/AuthZ flow, architecture/data-flow diagram, data-sensitivity classification, access control, exposed tools + OpenAPI, FP-dossier skeleton, and the written-policy /…
runverdict/sf-security-review-toolkit
Skill Claude CodeCodex
Stand up the partner's EXISTING released managed package in a throwaway scratch/trial org and audit the deployed artifact — exactly what the Salesforce reviewer does when they install your package. Pre-install contamination check, headless permission-chain verification (the install-time UEC grant drop), Connect API…
runverdict/sf-security-review-toolkit
Skill Claude CodeCodex
Phase 4 of security review prep. Guided runbooks for the reviewer-facing test environment — the review org, the configured agent with Topics and a validated utterance list (MCP listings), two test users with a bidirectional authorization proof, the isolated external test tenant, and the end-to-end self-test that makes…
runverdict/sf-security-review-toolkit
Skill Claude CodeCodex
Audit the submission AS THE SALESFORCE REVIEWER WILL. Runs the Product-Security challenge checklist (reviewer-challenges.md) against the audit ledger + scan evidence + the scope manifest, and emits a "what the reviewer will see" report — every challenge marked WILL-FIND / ADDRESSED-fixed / ADDRESSED-refuted(FP) /…
runverdict/sf-security-review-toolkit
Skill Claude CodeCodex
Phase 3 of security review prep. Orchestrates every scan family the review consumes — Code Analyzer (package SAST), the Partner Security Portal scanner check, authenticated DAST (+ Nuclei/Schemathesis) plan generation, TLS grading (SSL Labs or local testssl/sslyze), dependency audits, secret scan, and the…
runverdict/sf-security-review-toolkit
Skill Claude CodeCodex
Phase 0 of security review prep. Detects the partner's architecture elements (managed package, MCP server, external web app/API, Canvas, LWC/Aura, mobile) from the repo plus an optional live MCP probe, runs the partner-program preflight gates, compiles which baseline requirements apply, and writes the scope manifest…
runverdict/sf-security-review-toolkit
Skill Claude CodeCodex
Autonomous driver for AppExchange/AgentExchange security-review SUBMISSION readiness. Runs a seconds-long preflight (greps + architecture detection + sf CLI auto-resolve when authed), emits one 3-tier preflight report, then drives the whole journey end to end — scope, static scans, audit, artifacts, live scans…
runverdict/sf-security-review-toolkit
Skill Claude CodeCodex
Post-approval obligations on a recurring cadence — re-review trigger watch, the per-release security-relevance gate before listing association, the 24-hour incident-reporting duty, platform mandate sweeps, evidence-freshness re-runs, test-environment liveness, and re-verification of this toolkit's own baseline. Use…
runverdict/sf-security-review-toolkit
Skill Claude CodeCodex
Provision a clean throwaway org and leave zero residue after the deployed-package audit — remove an MCP server registration (agent references, tool actions, the MCP Servers registry row, ESR/Named Credential/External Credential, and the permission set) in the dependency order that works. Used by the deep audit to…