The current catalog contains 157 Salesforce skills
The 84.3 MB measured checkout led to a main branch with 157 SKILL.md directories when fetched. Their scope reaches across Apex generation and tests, SOQL, Flow, Lightning Web Components, Experience Cloud, metadata deployment, permissions, Agentforce, Data 360, integrations, mobile apps, Commerce, OmniStudio, and service operations. Each skill can carry executable scripts, references, assets, and schemas beside its instructions, so this is much more than a prompt list.
That breadth helps a Salesforce team find domain vocabulary and ordered procedures in one place. It also makes selection important. A global install exposes a coding agent to many overlapping triggers and thousands of supporting files. The measured commit had 7,244 files and about 255,451 source lines. Teams should inspect which skills activate for their normal requests and remove or pin anything they do not intend to use.
Claude Code and Codex share the same one-command install
Release 1.42.0 documents npx skills add forcedotcom/sf-skills for Claude Code, Codex, Cursor, OpenCode, and other Agent Skills clients. Agentforce Vibes receives the catalog automatically and keeps it updated. The folders follow the open Agent Skills structure: a required SKILL.md, plus optional scripts, reference documents, and assets. That common format makes the text portable even when a skill's Salesforce commands depend on one client or service.
Claude Desktop is a separate case. Issue 318 says the local-folder installation command does not work there because custom skills must be packaged and uploaded through the product interface. The repository's usage table does not document that route. Desktop users should not assume Claude Code compatibility means identical installation, and maintainers distributing to both clients need a packaging step outside the current quick start.
What happened when we ran it
Our sandbox installed 248 npm packages in 20 seconds and occupied 149 MB. Npm audit found 0 known vulnerabilities. The package exposed no build script and no test script, so both stages were skipped. Those results cover the npm dependency tree at commit 2476476; they do not prove that any Salesforce workflow produced correct metadata or deployed successfully.
The 84.3 MB checkout contained 4 CI workflow files, no Dockerfile, and no tests directory according to our scan. The package does define a separate validate:skills command, but the lab's standard test target did not call it. We will not turn an unrun validation command into a passing result. Likewise, the absence of a standard build target is expected for a content catalog, yet it leaves fewer familiar checks for downstream automation.
Our measurement setup used a fresh unprivileged Debian container with 3 CPUs, 8 GB of RAM, Node.js 22, and no secrets. We did not connect a Salesforce org, run Agentforce Vibes, install the catalog into Claude Code, or execute a skill. Correctness still depends on the chosen skill, its current references, the agent, org permissions, API version, and the review applied before changes reach a real environment.
Release 1.42.0 removed seven Data 360 skills
Release 1.42.0 removed 7 data360-* skills shortly after the measured commit. The README warns that the catalog changes frequently and does not offer the stability guarantees of generally available Salesforce APIs. Skills may be renamed, moved, or removed. Agentforce Vibes auto-updates, while a fork or local sync may instead face conflicts with edits made inside copied skill directories.
Pinning matters for repeatable agent behavior. A skill change can alter triggers, steps, commands, or references even when the underlying Salesforce API stays the same. Record the commit used by CI or a controlled agent, review release diffs, and retest the workflows that can deploy metadata or modify org data. Automatic updates are convenient for discovery, but they are a poor fit for a regulated change process without an approval gate.
The repository declares two incompatible licenses
GitHub identifies the repository license as Apache-2.0, and LICENSE.txt contains that license. At commit 2476476, however, the npm package declared CC-BY-NC-4.0. Issue 316 asks Salesforce to say which is authoritative because one permits commercial use and the other carries a noncommercial restriction. This is a concrete adoption blocker for companies whose review process requires consistent license metadata.
A reviewer should not guess which file wins. Check whether the mismatch has been resolved in the exact release you plan to use and obtain the required internal approval. The latest fetched release was 1.42.0 on August 25, 2026, and the repository was pushed the same day. GitHub listed 928 stars and 31 open issues and pull requests, which shows current activity but does not answer the licensing question.
Skill output still needs Salesforce-native validation
Across 157 skills, workflows can generate Apex, Flows, Lightning components, permission sets, metadata, queries, and deployment commands. The useful part is their domain-specific sequence and reference material. The risk is that a confident agent can apply an outdated example or choose the wrong org. Issue 320, for example, reports a hand-built modal asset that conflicts with the catalog's own advice to prefer the native lightning/modal component.
Issue 288 reports that a documentation-fetching script returned cookie-shell text instead of the requested developer article, despite an HTTP 200 response. Issue 210 describes a Flow skill asking an enabled MCP integration for an unsupported action. These are narrow, citable failures rather than a judgment on all 157 skills. They justify trying selected skills against a scratch org, checking generated metadata with Salesforce tools, and keeping a human approval step before deployment.