salesforce-core plugin
Sixteen general-purpose Salesforce admin & developer skills — Apex, Flow, SOQL/Data, LWC, Metadata, Permissions, Diagrams, Org Audit, Test Generation, Security Review, Debug Log Analysis, Org Comparison, Integrations, Record Stewardship, Campaign Analytics, and Lead Enrichment — that work with any Salesforce MCP server.
How to install the salesforce-core plugin
Run both commands inside Claude Code. The first adds the marketplace once; the second installs the plugin.
/plugin marketplace add kugamon/salesforce-core-skills
/plugin install salesforce-core@salesforce-core-marketplaceWhat's inside salesforce-core
19 parts read from the plugin's own files.
Agents 2
Call as @agent-salesforce-core:name- @agent-salesforce-core:apex-reviewerhaiku
>
- @agent-salesforce-core:security-auditorhaiku
>
Skills 16
Claude loads it when the task matches- sf-apex
Generates and reviews Salesforce Apex code with best practices and 150-point scoring using a Salesforce MCP server. Use when writing Apex classes, triggers, test classes, batch jobs, or reviewing existing Apex code for bulkification, security, and SOLID principles. Do NOT use for writing or scoring test classes (use sf-test), diagnosing runtime failures and governor-limit errors from debug logs (use sf-debug), or org-wide vulnerability scanning (use sf-security). Usage: /sf-apex [create|update|validate] [class|trigger|test-class] {name} ...
- sf-audit
Run a comprehensive Salesforce org audit producing 18 documents from a single scan. Inventories and scores Apex classes, triggers, Flows, Process Builders, Workflow Rules, LWC components, custom objects/fields, validation rules, formula fields, approval processes, escalation/assignment/auto-response rules, Profiles, and Permission Sets. Detects unused custom fields and objects (no data and/or no references in code, flows, layouts, or reports). Also covers Reports & Dashboards, integrations, test coverage, licensing, team evaluation, change history, data quality, and architectural analysis. Scans all formula and criteria logic for hardcoded Record IDs, Campaign names, Profile names, URLs, and other fragile values. Generates Word, Excel, HTML reports plus 12 standalone analysis documents including a customer report and strategic engagement plan. Do NOT use for a targeted vulnerability scan (use sf-security), comparing two orgs for drift (use sf-orgdiff), answering 'who has access to X' (use sf-permissions), or
- sf-campaigns
Analyzes Salesforce campaign performance via a Salesforce MCP server — member counts, response and conversion rates, pipeline generated, ROI, cost per lead, and lead-source patterns. Use when the user asks to analyze campaigns, check campaign performance or ROI, asks "which campaigns are working", wants a campaign report, campaign metrics, campaign member analysis, or lead source analysis. Do NOT use for raw SOQL or DML against campaign records (use sf-data), enriching lead or contact fields from the web (use sf-leads), or org-wide data-quality auditing (use sf-audit). Usage: /sf-campaigns [report|analyze|compare] {campaign-name} ...
- sf-data
Salesforce data and SOQL expert. Execute SOQL queries (natural language or raw SOQL), build optimized queries with selectivity analysis, insert/update/upsert/delete records, validate data operations, describe objects, and manage test data via Salesforce MCP server. Do NOT use for creating objects, fields, or validation rules (use sf-metadata), web-research enrichment of leads and contacts (use sf-leads), campaign performance analytics (use sf- campaigns), or org-wide data-quality auditing (use sf-audit). Usage: /sf-data [query|build-query|insert|update|upsert|delete|validate|describe] {target} ...
- sf-debug
Captures and analyzes Salesforce debug logs through the Tooling API — trace flag setup, log retrieval, parsing for exceptions, SOQL-in-loop detection, CPU/heap/limit analysis, and row-lock diagnosis — all MCP-first against the live org. Use when the user hits an error in Salesforce, mentions debug logs, governor limits, "too many SOQL queries", CPU timeouts, UNABLE_TO_LOCK_ROW, flow errors, or asks why something failed in the org. Do NOT use for writing or refactoring Apex (use sf-apex), generating or running test classes (use sf-test), or a broad org-wide quality inventory (use sf-audit). Usage: /sf-debug [trace|logs|analyze|limits] {user|class|logId} ...
- sf-diagram
Creates Salesforce architecture diagrams using Mermaid with ASCII fallback. Use when visualizing OAuth flows, data models (ERDs), integration sequences, system landscapes, role hierarchies, or Agentforce agent architectures. Do NOT use for inventorying or scoring org metadata (use sf-audit), retrieving object and field definitions (use sf-metadata), or auditing who has access to what (use sf-permissions) — this skill draws diagrams from data those skills supply. Usage: /sf-diagram [oauth|erd|integration|landscape|hierarchy|agentforce] ...
- sf-flow
Creates and validates Salesforce flows with 110-point scoring and Winter '26 best practices using Salesforce MCP server. Use when building record-triggered flows, screen flows, autolaunched flows, scheduled flows, or reviewing existing flow performance. Do NOT use for Apex classes and triggers (use sf-apex), creating the objects and fields a flow references (use sf-metadata), or diagnosing a flow failure at runtime from debug logs (use sf- debug). Usage: /sf-flow [create|update|validate] {FlowName} ...
- sf-integration
Sets up and reviews Salesforce integrations — Named Credentials and External Credentials (creation, principal design, migration from legacy credentials and Remote Site Settings), OAuth flow selection, Platform Events (define/publish/subscribe/monitor/replay), Change Data Capture, and org-wide integration audits — MCP-first against the live org. Use when the user mentions a named credential, external credential, wants to connect to an external API, asks which OAuth flow to use, mentions platform events, CDC, change data capture, an integration audit, or callout setup. Do NOT use for creating custom objects and fields (use sf-metadata), scanning code for hardcoded secrets and vulnerabilities (use sf-security), or tracing callout failures and stalled subscribers in debug logs (use sf-debug). Usage: /sf-integration [credentials|events|cdc|review] {name} ...
- sf-leads
Enriches Salesforce Lead and Contact records with verified data from web research — titles, industries, websites, company size, LinkedIn profiles — writing back via a Salesforce MCP server with per-field source citations and user approval before every update. Use when the user asks to enrich leads or contacts, fill in missing lead data, research a lead's company, update lead info from the web, or fix incomplete lead records. Do NOT use for bulk SOQL or DML against lead records (use sf-data), campaign performance and ROI analysis (use sf-campaigns), or org-wide data-quality auditing (use sf-audit). Usage: /sf-leads [find|enrich|report] {lead-name|criteria} ...
- sf-lwc
Lightning Web Components development with PICKLES architecture methodology, component scaffolding, wire service patterns, event handling, Apex integration, GraphQL support, and Jest test generation. Powered by Salesforce MCP server for seamless metadata deployment. Do NOT use for Apex controllers and @AuraEnabled methods (use sf-apex), Flow screen automation (use sf-flow), or org-wide component inventory and scoring (use sf-audit). Usage: /sf-lwc [create|update|validate] {ComponentName} ...
- sf-metadata
Salesforce metadata operations expert. Use when creating custom objects, fields, validation rules, record types, permission sets, or querying org metadata structures via a Salesforce MCP server. Do NOT use for comparing metadata across two orgs (use sf-orgdiff), Named or External Credentials and Platform Events (use sf-integration), or querying and loading records (use sf- data). Usage: /sf-metadata [create|update|delete|describe] {ObjectName|FieldName|type} ...
- sf-orgdiff
Compares two connected Salesforce orgs through their MCP connectors — inventory-first metadata diffing across Apex, Flows, objects/fields, validation rules, permission sets, layouts, labels, endpoints, and installed packages — producing a drift report with severity flags and a reconciliation plan. Strictly read-only on both orgs. Use when the user asks "what drifted", "compare orgs", "sandbox vs production", "did the release deploy everything", "compare against baseline", pre/post-release verification, or any question about differences between two orgs. Do NOT use for auditing a single org's quality (use sf-audit), creating or deploying metadata (use sf-metadata), or vulnerability scanning (use sf-security). Usage: /sf-orgdiff [drift|release|baseline] {source-connector} {target-connector} [scope] ...
- sf-permissions
Permission Set analysis, hierarchy viewer, and "Who has X?" auditing. Use when analyzing permissions, visualizing PS/PSG hierarchies, finding which Permission Sets grant access to specific objects, fields, or Apex classes, or auditing user permissions via a Salesforce MCP server. Do NOT use for scanning code for vulnerabilities (use sf-security), a broad org-wide quality inventory (use sf-audit), or comparing permissions across two orgs (use sf-orgdiff). Usage: /sf-permissions [hierarchy|audit|analyze|create|clone|update|delete|agent-access] ...
- sf-records
Record stewardship for a Salesforce object — profiles data health field by field, finds and plans duplicate merges, proposes and applies corrections in approved batches, and runs mass updates with a rollback plan. Describe-first against the live org, every write proposed before it lands and verified after. Use when the user says "clean up my accounts", "find duplicate contacts", "what's wrong with our opportunity data", "fix these records", "bulk update", "data health check on X", "merge these duplicates", "our contacts are a mess", or asks how bad the data on an object is. Do NOT use for writing or running queries and DML mechanics (use sf-data), enriching records from web research (use sf-leads), campaign performance analysis (use sf-campaigns), or org-wide quality audits (use sf-audit). Usage: /sf-records [inspect|dedupe|fix|bulk] {object} [criteria] ...
- sf-security
Audits Salesforce orgs and codebases for security vulnerabilities — CRUD/FLS enforcement, SOQL injection, sharing violations, hardcoded secrets, unsafe Lightning patterns, and PII exposure — with a 100-point scored report and an AppExchange security review readiness checklist. Use when the user asks for a security audit, security review, vulnerability scan, AppExchange submission prep, CRUD/FLS check, or asks "is this code secure". Do NOT use for a broad org-wide quality inventory (use sf-audit), 'who has access to X' permission questions (use sf-permissions), comparing two orgs (use sf-orgdiff), or general Apex refactoring (use sf-apex). Usage: /sf-security [audit|review|fix] [org|class|component] {name} ...
- sf-test
Generates, reviews, and runs Salesforce Apex test classes with a 120-point test-quality scoring rubric using a Salesforce MCP server. Use when writing test classes, improving code coverage, reviewing existing tests for assertion quality and bulk safety, running test suites, or diagnosing coverage gaps before a deployment or AppExchange submission. Do NOT use for writing or refactoring production Apex (use sf-apex), diagnosing runtime failures from debug logs (use sf-debug), or scanning code for security vulnerabilities (use sf-security). Usage: /sf-test [generate|review|run] [class|all] {name} ...
Hooks 1
Runs on these events- PreToolUsecommand
mcp__.*__metadata_create|mcp__.*__metadata_update|mcp__.*__t
Using salesforce-core in Claude Code
Ask for an agent by name:
@agent-salesforce-core:apex-reviewer
@agent-salesforce-core:security-auditorSkills need no command. Claude reads them when your request matches what they describe.
Update, turn off or remove
- Update the plugin (shell)
- claude plugin update salesforce-core@salesforce-core-marketplace
- Refresh the marketplace
- /plugin marketplace update salesforce-core-marketplace
- Turn it off for now
- /plugin disable salesforce-core@salesforce-core-marketplace
- Remove it
- /plugin uninstall salesforce-core@salesforce-core-marketplace
Skills in salesforce-core
- sf-apexkugamon/salesforce-core-skills
Generates and reviews Salesforce Apex code with best practices and 150-point scoring using a Salesforce MCP server. Use when writing Apex classes, triggers, test classes, batch jobs, or reviewing existing Apex code for bulkification, security, and SOLID principles. Do NOT use for writing or scoring test classes (use sf-test), diagnosing runtime failures and governor-limit errors from debug logs (use sf-debug), or org-wide vulnerability scanning (use sf-security). Usage: /sf-apex [create|update|validate] [class|trigger|test-class] {name} ...
41 files5stars - sf-auditkugamon/salesforce-core-skills
Run a comprehensive Salesforce org audit producing 18 documents from a single scan. Inventories and scores Apex classes, triggers, Flows, Process Builders, Workflow Rules, LWC components, custom objects/fields, validation rules, formula fields, approval processes, escalation/assignment/auto-response rules, Profiles, and Permission Sets. Detects unused custom fields and objects (no data and/or no references in code, flows, layouts, or reports). Also covers Reports & Dashboards, integrations, test coverage, licensing, team evaluation, change history, data quality, and architectural analysis. Scans all formula and criteria logic for hardcoded Record IDs, Campaign names, Profile names, URLs, and other fragile values. Generates Word, Excel, HTML reports plus 12 standalone analysis documents including a customer report and strategic engagement plan. Do NOT use for a targeted vulnerability scan (use sf-security), comparing two orgs for drift (use sf-orgdiff), answering 'who has access to X' (use sf-permissions), or
11 files5stars - sf-campaignskugamon/salesforce-core-skills
Analyzes Salesforce campaign performance via a Salesforce MCP server — member counts, response and conversion rates, pipeline generated, ROI, cost per lead, and lead-source patterns. Use when the user asks to analyze campaigns, check campaign performance or ROI, asks "which campaigns are working", wants a campaign report, campaign metrics, campaign member analysis, or lead source analysis. Do NOT use for raw SOQL or DML against campaign records (use sf-data), enriching lead or contact fields from the web (use sf-leads), or org-wide data-quality auditing (use sf-audit). Usage: /sf-campaigns [report|analyze|compare] {campaign-name} ...
5 files5stars - sf-datakugamon/salesforce-core-skills
Salesforce data and SOQL expert. Execute SOQL queries (natural language or raw SOQL), build optimized queries with selectivity analysis, insert/update/upsert/delete records, validate data operations, describe objects, and manage test data via Salesforce MCP server. Do NOT use for creating objects, fields, or validation rules (use sf-metadata), web-research enrichment of leads and contacts (use sf-leads), campaign performance analytics (use sf- campaigns), or org-wide data-quality auditing (use sf-audit). Usage: /sf-data [query|build-query|insert|update|upsert|delete|validate|describe] {target} ...
63 files5stars - sf-debugkugamon/salesforce-core-skills
Captures and analyzes Salesforce debug logs through the Tooling API — trace flag setup, log retrieval, parsing for exceptions, SOQL-in-loop detection, CPU/heap/limit analysis, and row-lock diagnosis — all MCP-first against the live org. Use when the user hits an error in Salesforce, mentions debug logs, governor limits, "too many SOQL queries", CPU timeouts, UNABLE_TO_LOCK_ROW, flow errors, or asks why something failed in the org. Do NOT use for writing or refactoring Apex (use sf-apex), generating or running test classes (use sf-test), or a broad org-wide quality inventory (use sf-audit). Usage: /sf-debug [trace|logs|analyze|limits] {user|class|logId} ...
6 files5stars - sf-diagramkugamon/salesforce-core-skills
Creates Salesforce architecture diagrams using Mermaid with ASCII fallback. Use when visualizing OAuth flows, data models (ERDs), integration sequences, system landscapes, role hierarchies, or Agentforce agent architectures. Do NOT use for inventorying or scoring org metadata (use sf-audit), retrieving object and field definitions (use sf-metadata), or auditing who has access to what (use sf-permissions) — this skill draws diagrams from data those skills supply. Usage: /sf-diagram [oauth|erd|integration|landscape|hierarchy|agentforce] ...
37 files5stars - sf-flowkugamon/salesforce-core-skills
Creates and validates Salesforce flows with 110-point scoring and Winter '26 best practices using Salesforce MCP server. Use when building record-triggered flows, screen flows, autolaunched flows, scheduled flows, or reviewing existing flow performance. Do NOT use for Apex classes and triggers (use sf-apex), creating the objects and fields a flow references (use sf-metadata), or diagnosing a flow failure at runtime from debug logs (use sf- debug). Usage: /sf-flow [create|update|validate] {FlowName} ...
64 files5stars - sf-integrationkugamon/salesforce-core-skills
Sets up and reviews Salesforce integrations — Named Credentials and External Credentials (creation, principal design, migration from legacy credentials and Remote Site Settings), OAuth flow selection, Platform Events (define/publish/subscribe/monitor/replay), Change Data Capture, and org-wide integration audits — MCP-first against the live org. Use when the user mentions a named credential, external credential, wants to connect to an external API, asks which OAuth flow to use, mentions platform events, CDC, change data capture, an integration audit, or callout setup. Do NOT use for creating custom objects and fields (use sf-metadata), scanning code for hardcoded secrets and vulnerabilities (use sf-security), or tracing callout failures and stalled subscribers in debug logs (use sf-debug). Usage: /sf-integration [credentials|events|cdc|review] {name} ...
6 files5stars - sf-leadskugamon/salesforce-core-skills
Enriches Salesforce Lead and Contact records with verified data from web research — titles, industries, websites, company size, LinkedIn profiles — writing back via a Salesforce MCP server with per-field source citations and user approval before every update. Use when the user asks to enrich leads or contacts, fill in missing lead data, research a lead's company, update lead info from the web, or fix incomplete lead records. Do NOT use for bulk SOQL or DML against lead records (use sf-data), campaign performance and ROI analysis (use sf-campaigns), or org-wide data-quality auditing (use sf-audit). Usage: /sf-leads [find|enrich|report] {lead-name|criteria} ...
6 files5stars - sf-lwckugamon/salesforce-core-skills
Lightning Web Components development with PICKLES architecture methodology, component scaffolding, wire service patterns, event handling, Apex integration, GraphQL support, and Jest test generation. Powered by Salesforce MCP server for seamless metadata deployment. Do NOT use for Apex controllers and @AuraEnabled methods (use sf-apex), Flow screen automation (use sf-flow), or org-wide component inventory and scoring (use sf-audit). Usage: /sf-lwc [create|update|validate] {ComponentName} ...
62 files5stars - sf-metadatakugamon/salesforce-core-skills
Salesforce metadata operations expert. Use when creating custom objects, fields, validation rules, record types, permission sets, or querying org metadata structures via a Salesforce MCP server. Do NOT use for comparing metadata across two orgs (use sf-orgdiff), Named or External Credentials and Platform Events (use sf-integration), or querying and loading records (use sf- data). Usage: /sf-metadata [create|update|delete|describe] {ObjectName|FieldName|type} ...
43 files5stars - sf-orgdiffkugamon/salesforce-core-skills
Compares two connected Salesforce orgs through their MCP connectors — inventory-first metadata diffing across Apex, Flows, objects/fields, validation rules, permission sets, layouts, labels, endpoints, and installed packages — producing a drift report with severity flags and a reconciliation plan. Strictly read-only on both orgs. Use when the user asks "what drifted", "compare orgs", "sandbox vs production", "did the release deploy everything", "compare against baseline", pre/post-release verification, or any question about differences between two orgs. Do NOT use for auditing a single org's quality (use sf-audit), creating or deploying metadata (use sf-metadata), or vulnerability scanning (use sf-security). Usage: /sf-orgdiff [drift|release|baseline] {source-connector} {target-connector} [scope] ...
6 files5stars - sf-permissionskugamon/salesforce-core-skills
Permission Set analysis, hierarchy viewer, and "Who has X?" auditing. Use when analyzing permissions, visualizing PS/PSG hierarchies, finding which Permission Sets grant access to specific objects, fields, or Apex classes, or auditing user permissions via a Salesforce MCP server. Do NOT use for scanning code for vulnerabilities (use sf-security), a broad org-wide quality inventory (use sf-audit), or comparing permissions across two orgs (use sf-orgdiff). Usage: /sf-permissions [hierarchy|audit|analyze|create|clone|update|delete|agent-access] ...
15 files5stars - sf-recordskugamon/salesforce-core-skills
Record stewardship for a Salesforce object — profiles data health field by field, finds and plans duplicate merges, proposes and applies corrections in approved batches, and runs mass updates with a rollback plan. Describe-first against the live org, every write proposed before it lands and verified after. Use when the user says "clean up my accounts", "find duplicate contacts", "what's wrong with our opportunity data", "fix these records", "bulk update", "data health check on X", "merge these duplicates", "our contacts are a mess", or asks how bad the data on an object is. Do NOT use for writing or running queries and DML mechanics (use sf-data), enriching records from web research (use sf-leads), campaign performance analysis (use sf-campaigns), or org-wide quality audits (use sf-audit). Usage: /sf-records [inspect|dedupe|fix|bulk] {object} [criteria] ...
7 files5stars - sf-securitykugamon/salesforce-core-skills
Audits Salesforce orgs and codebases for security vulnerabilities — CRUD/FLS enforcement, SOQL injection, sharing violations, hardcoded secrets, unsafe Lightning patterns, and PII exposure — with a 100-point scored report and an AppExchange security review readiness checklist. Use when the user asks for a security audit, security review, vulnerability scan, AppExchange submission prep, CRUD/FLS check, or asks "is this code secure". Do NOT use for a broad org-wide quality inventory (use sf-audit), 'who has access to X' permission questions (use sf-permissions), comparing two orgs (use sf-orgdiff), or general Apex refactoring (use sf-apex). Usage: /sf-security [audit|review|fix] [org|class|component] {name} ...
7 files5stars - sf-testkugamon/salesforce-core-skills
Generates, reviews, and runs Salesforce Apex test classes with a 120-point test-quality scoring rubric using a Salesforce MCP server. Use when writing test classes, improving code coverage, reviewing existing tests for assertion quality and bulk safety, running test suites, or diagnosing coverage gaps before a deployment or AppExchange submission. Do NOT use for writing or refactoring production Apex (use sf-apex), diagnosing runtime failures from debug logs (use sf-debug), or scanning code for security vulnerabilities (use sf-security). Usage: /sf-test [generate|review|run] [class|all] {name} ...
6 files5stars
salesforce-core plugin questions
How do I install the salesforce-core plugin?
In Claude Code run /plugin marketplace add kugamon/salesforce-core-skills, then /plugin install salesforce-core@salesforce-core-marketplace.
What does the salesforce-core plugin include?
salesforce-core bundles 2 agents, 16 skills, hooks.
Which agents come with salesforce-core?
apex-reviewer, security-auditor. Call one with @agent-salesforce-core:apex-reviewer.
How do I update or remove the salesforce-core plugin?
Update it with claude plugin update salesforce-core@salesforce-core-marketplace in your shell, or from the Installed tab of /plugin. Remove it with /plugin uninstall salesforce-core@salesforce-core-marketplace.
What license is the salesforce-core plugin under?
MIT, as stated in the plugin's manifest.