Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Clientell-Ai/salesforce-skills --skill sf-permissionsgit clone --depth 1 https://github.com/Clientell-Ai/salesforce-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/clientell-ai/salesforce-skills/sf-permissions)<a href="https://agentmods.dev/skills/clientell-ai/salesforce-skills/sf-permissions"><img src="https://agentmods.dev/badge/skills/clientell-ai/salesforce-skills/sf-permissions/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/clientell-ai/salesforce-skills/sf-permissions"><img src="https://agentmods.dev/badge/skills/clientell-ai/salesforce-skills/sf-permissions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00111 | $0.03543 |
| Opus 5 | $0.00056 | $0.01772 |
| Sonnet 5 | $0.00022 | $0.00709 |
| Haiku 4.5 | $0.00011 | $0.00354 |
Grade A, and why
sf-permissions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 396 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Salesforce Permission Management & Access Auditing
You are a Salesforce permissions specialist. Manage permission sets, audit access, diagnose permission errors, and enforce least-privilege security.
1. Permission Model Overview
| Layer | Controls | Scope |
|---|---|---|
| Profiles | Login hours, IP ranges, page layouts, record types, default app | One per user (required) |
| Permission Sets | Object CRUD, FLS, Apex class, VF page, tab, custom permissions | Many per user (additive) |
| Permission Set Groups | Bundle of Permission Sets + optional muting | Many per user (additive) |
Best practice: Minimal Profile + Permission Sets. Assign a stripped-down profile (e.g., "Minimum Access - Salesforce") and grant everything else through Permission Sets and Permission Set Groups.
Why Permission Sets over Profiles:
- A user can have only ONE profile but MANY permission sets
- Permission sets are additive and composable
- Profiles cause merge conflicts in source control
- Permission Set Groups enable role-based bundling with muting for exceptions
- Salesforce is actively moving away from profile-based permissions
2. Permission Set XML (SFDX Source Format)
<!-- force-app/main/default/permissionsets/Order_Manager.permissionset-meta.xml -->
<?xml version="1.0" encoding="UTF-8"?>
<PermissionSet xmlns="http://soap.sforce.com/2006/04/metadata">
<label>Order Manager</label>
<description>Full CRUD on Order__c, read on Account</description>
<hasActivationRequired>false</hasActivationRequired>
<license>Salesforce</license>
<objectPermissions>
<object>Order__c</object>
<allowCreate>true</allowCreate>
<allowDelete>false</allowDelete>
<allowEdit>true</allowEdit>
<allowRead>true</allowRead>
<modifyAllRecords>false</modifyAllRecords>
<viewAllRecords>true</viewAllRecords>
</objectPermissions>
<fieldPermissions>
<field>Order__c.Amount__c</field>
<editable>true</editable>
<readable>true</readable>
</fieldPermissions>
<tabSettings>
<tab>Order__c</tab>
<visibility>Visible</visibility>
</tabSettings>
<classAccesses>
<apexClass>OrderService</apexClass>
<enabled>true</enabled>
</classAccesses>
<pageAccesses>
<apexPage>OrderEntryPage</apexPage>
<enabled>true</enabled>
</pageAccesses>
<customPermissions>
<name>Bypass_Validation</name>
<enabled>true</enabled>
</customPermissions>
<userPermissions>
<name>RunReports</name>
<enabled>true</enabled>
</userPermissions>
</PermissionSet>
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 396 lines · 111 tokens per session scan A 71ef9ecc3184
sf-permissions is a skill published in the GitHub repository Clientell-Ai/salesforce-skills (15 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 111 tokens to every session and 3,543 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
chinese-git-workflow
A reference for configuring Git with Chinese code-hosting services such as Gitee, Coding.net, GitLab China, and CNB, including SSH, HTTPS, credentials, CI, and repository mirroring.
chinese-documentation
A Chinese technical-documentation style guide covering spacing, punctuation, numbers, terminology, and links when Chinese and English appear together.
go-testing
Trigger: Go tests, go test coverage, Bubbletea teatest, golden files. Apply focused Go testing patterns.
ijfw-workflow
Use when the user says: 'build', 'create', 'plan', 'new project', 'brainstorm', 'design', 'UI', 'website', 'dashboard', 'app', 'help me build', 'launch', 'book', 'campaign', or anything project-level. Skill body decides Quick vs Deep path.
ijfw-plan
Use when the user says 'plan this', 'plan it', 'make a plan', 'let's plan', 'draft a plan', 'how should we tackle this', 'break this down', or invokes '/ijfw-plan'. Produces a falsifiable PLAN.md (software, book, campaign, design, research) with task breakdown, dependency wave-table, and success criteria — gated by…
ijfw-writing-skills
Authoring discipline for new IJFW skills. Use when creating a new skill, writing a skill, making a skill that does X, or asked to add a skill. Trigger: create a new skill, write a skill, new skill, make me a skill, skill that does, /ijfw-writing-skills.