What is dx-org-manage?

A Salesforce tool for managing development orgs and snapshots through command-line operations. A scratch org is a temporary Salesforce environment used for development and testing.

Use it to create, list, display, resume, or delete scratch orgs, create org snapshots, and open orgs in a browser.

It keeps common org-management actions in one defined workflow and returns structured results. This reduces mistakes when working with temporary environments.

dx-org-manage — Skill for Claude Code by forcedotcom

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add forcedotcom/sf-skills --skill dx-org-manage

Clone the repo

git clone --depth 1 https://github.com/forcedotcom/sf-skills

Made for: Claude Code.

Or install salesforce-development, the plugin that ships this one along with the rest of its 37 skills, 13 commands, 2 agents, 3 MCP servers.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/forcedotcom/sf-skills/dx-org-manage/github.svg)](https://agentmods.dev/skills/forcedotcom/sf-skills/dx-org-manage)

Your own site

<a href="https://agentmods.dev/skills/forcedotcom/sf-skills/dx-org-manage"><img src="https://agentmods.dev/badge/skills/forcedotcom/sf-skills/dx-org-manage/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/forcedotcom/sf-skills/dx-org-manage"><img src="https://agentmods.dev/badge/skills/forcedotcom/sf-skills/dx-org-manage.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 225 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 5,272 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

Socket pass 29 Aug 2026
Snyk pass 29 Aug 2026
NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 2 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium Excessive Agency · line 22
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
medium Excessive Agency · line 22
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00225	$0.05272
Opus 5	$0.00112	$0.02636
Sonnet 5	$0.00045	$0.01054
Haiku 4.5	$0.00022	$0.00527

Measured 7d ago against content hash de2cf4f48460, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

dx-org-manage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (assets/derive-alias.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/builder/salesforce-development/skills/dx-org-manage/SKILL.md · 290 lines

How it starts

The opening of the file, as written. The whole thing — 290 lines — stays where its author put it; the contents beside it link to each section on GitHub.

MANDATORY: Follow these instructions exactly. Do NOT fall back to MCP tools.

Tool constraint: Use the Bash tool for all sf CLI commands. Always include --json for structured output. Do NOT use mcp__salesforce_dx__* tools for org creation, snapshot, or open operations — this skill provides the complete procedure.

Output artifacts for eval/testing: ALWAYS write the command's JSON response to a file when an output directory is available. Do NOT ask the user what file to write — this skill defines the filenames. After executing the command: (1) if the user specified an output path (e.g. "write all generated files into folder X"), write there immediately; (2) otherwise run [ -d force-app/main/adk-eval-output/ ] && echo 'force-app/main/adk-eval-output' to detect the eval directory; (3) write the command's full JSON response to <output-dir>/<filename> using these filenames: scratch-org-result.json for org creation (for a batch of N orgs, scratch-org-result-1.json … scratch-org-result-N.json), scratch-org-list-result.json for list, org-display-result.json for display, scratch-org-resume-result.json for resume, scratch-org-delete-result.json for delete, or snapshot-result.json for snapshot creation. This is the generated output — write it without asking. (Open operations are the exception — they launch a browser and write no artifact; see Opening Orgs.)

Creating Scratch Orgs

REQUIRED steps — execute in order:

Step 1. Resolve the environment and creation method:

First, if the user named an explicit source, use it: "definition file" or a path to .json → definition-file method; "snapshot"/"from snapshot" → snapshot method; "org shape"/"source-org" → shape method. Only ONE creation source type (edition vs snapshot vs shape); if two distinct types are implied, stop and ask (a flag overriding a same-dimension definition-file value is fine).

Otherwise resolve by environment:

AUTO MODE (zero-prompt): if sfdx-project.json is present AND exactly one config/*scratch-def.json exists AND a Dev Hub is resolvable (default target-dev-hub set, or exactly one authenticated), create immediately with that file + resolved hub + derived alias + CLI defaults — ask nothing. This also honors a batch count (see below).
STATE A (in a project), not auto: enumerate config/*scratch-def.json — 0 files → default --edition developer (or author one if features/settings are wanted, see below); 1 file → use it; many → ask which one (never silently pick).
STATE B (no sfdx-project.json): do NOT block and do NOT silently create a throwaway — present the guided 3-way choice (point to a project / scaffold one via sf template generate project --name <name> / create a throwaway here, then guide the source). See references/scratch-org-create.md.

Read the full file on GitHub · 290 lines

Files

What ships with it

24 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

7d ago First seen · 290 lines · 225 tokens per session scan A de2cf4f48460

Subscribe to this mod's changes

dx-org-manage is a skill published in the GitHub repository forcedotcom/sf-skills (981 stars, last pushed 2d ago), licensed Apache-2.0. It adds 225 tokens to every session and 5,272 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Backend and APIs Cloud DevOps and cloud

stripe-projects

Provision SaaS services + sync creds via Stripe Projects.

NousResearch/hermes-agent · 15 tokens

azure-eventhub-dotnet

Azure Event Hubs SDK for .NET. Use for high-throughput event streaming: sending events (EventHubProducerClient, EventHubBufferedProducerClient), receiving events (EventProcessorClient with checkpointing), partition management, and real-time data ingestion. Triggers: "Event Hubs", "event streaming"…

microsoft/skills · 94 tokens

azure-mgmt-botservice-dotnet

Azure Resource Manager SDK for Bot Service in .NET. Management plane operations for creating and managing Azure Bot resources, channels (Teams, DirectLine, Slack), and connection settings. Triggers: "Bot Service", "BotResource", "Azure Bot", "DirectLine channel", "Teams channel", "bot management .NET", "create bot".

microsoft/skills · 78 tokens

wikipedia

Search and read Wikipedia via x wkp — MediaWiki API, no API key, zero install; query, extract, suggest, and DDG route in one module. Load for wiki, wikipedia, encyclopedia lookup, article summary.

x-cmd/x-cmd · 49 tokens

django-storages-s3

Use when configuring Django to store static and media files on AWS S3 with django-storages. Invoke when working with the STORAGES setting, S3 buckets, presigned URLs, CloudFront, or boto3-backed file storage in settings.py. Configures the Django 4.2+ STORAGES dict, public/private custom backends, presigned GET/POST…

Jeffallan/claude-skills · 138 tokens

cve

Look up CVE records via x cve — cached, zero-API-key, daily xz TSV. Load for cve, vulnerability id, kev, epss, nvd, cvelist, or security advisory.