SquireX Security Rule Catalog

192 rules across 85 categories.

Action Configuration

Rule ID	Severity	Name
AGENTFORCE-1.2	🔴 High	Schema Synchronization Verification

Agent Authority

Rule ID	Severity	Name
AGENTFORCE-36.1	🔴 High	Agent-Invoked Apex Exercises Authority Without a User Guard

Agent Flow Integrity

Rule ID	Severity	Name
AGENTFORCE-2.2	🟡 Medium	Transition Integrity

Agent Network Security

Rule ID	Severity	Name
AGENTFORCE-AF-22	🚨 Critical	Unsafe Deserialization in A2A Agent Server
AGENTFORCE-AF-21	🔴 High	A2A Task Endpoint Without Authentication

Agent Script Safety

Rule ID	Severity	Name
AGENTFORCE-2.1	🟡 Medium	Validation Guard Clause Enforcement
AGENTFORCE-2.3	🟡 Medium	Prompt Injection Defense Heuristics

AgentExchange Supply-Chain

Rule ID	Severity	Name
AGENTFORCE-SC-10	🚨 Critical	Tool Namespace Shadowing (Confused Deputy)
AGENTFORCE-SC-12	🔴 High	Transitive Prompt Poisoning
AGENTFORCE-SC-11	🔴 High	Unbound Gateway Activation

Agentforce for Commerce

Rule ID	Severity	Name
AGENTFORCE-17.1	🚨 Critical	Commerce Agent Without Idempotency Key
AGENTFORCE-17.2	🚨 Critical	Commerce Agent Amount Without Bounds Check

Agentic Architecture

Rule ID	Severity	Name
AGENTFORCE-7.1	🔴 High	Topic Action Bloat (God-Topic Prevention)
AGENTFORCE-7.2	🔴 High	Inadequate Skill Semantics
AGENTFORCE-8.1	🔴 High	Context Traversal Exfiltration (ForcedLeak Mitigation)
AGENTFORCE-7.3	🟢 Low	Orphaned Bot Without AiEvaluationDefinition

Autonomous Scheduling

Rule ID	Severity	Name
AGENTFORCE-11.1	🚨 Critical	Unguarded Autonomous Scheduled Action
AGENTFORCE-11.2	🔴 High	Time-Window Privilege Drift

Broken Access Control

Rule ID	Severity	Name
AGENTFORCE-25.3	🔴 High	SYSTEM_MODE Query Bypasses Sharing/FLS
AGENTFORCE-25.6	🔴 High	Apex without sharing Bypass
AGENTFORCE-26.1	🔴 High	Record Access by Caller-Supplied ID Without Sharing (IDOR)
AGENTFORCE-26.4	🔴 High	Agent-Called Apex Without Sharing or Permission Checks
AGENTFORCE-26.2	🔴 High	Agent Action Identity Parameter Without Session Binding
AGENTFORCE-APEX-03	🔴 High	Unrestricted Guest or Agent File Upload
AGENTFORCE-MCP-23	🔴 High	MCP Server Cache Shared Across Users or Tenants
AGENTFORCE-AF-19	🔴 High	Unauthenticated Endpoint Calls an Agent With the Server's Credential
AGENTFORCE-APEX-05	🔴 High	Async Apex Job Drops the Caller's Sharing Context
AGENTFORCE-AF-23	🔴 High	A2A Task Cancel or Subscribe Without Ownership Check
AGENTFORCE-APEX-01	🟡 Medium	Apex Entry Point Reads or Writes Caller-Controlled Records Without FLS
AGENTFORCE-APEX-04	🟡 Medium	Exposed Apex Query or DML Without CRUD/FLS Enforcement
AGENTFORCE-APEX-02	🟡 Medium	Entry Point Without Sharing Runs Privileged Operation on Caller-Supplied Records
AGENTFORCE-26.3	🟡 Medium	Agent Audience or Preference Scope Without RLS

CSRF

Rule ID	Severity	Name
AGENTFORCE-25.4	🔴 High	CSRF via ApexPages Parameter DML
AGENTFORCE-VF-02	🔴 High	Visualforce CSRF via page action

Coding-Agent Configuration

Rule ID	Severity	Name
AGENTCFG-01	🔴 High	Coding Agent Approval or Sandbox Disabled
AGENTCFG-02	🔴 High	Coding Agent Pre-Approves Arbitrary Shell Commands
AGENTCFG-03	🟡 Medium	Coding Agent Auto-Trusts Repository MCP Servers
AGENTCFG-04	🟢 Low	Personal Coding-Agent Settings Committed

Credential Exposure

Rule ID	Severity	Name
AGENTFORCE-SEC-01	🚨 Critical	Committed Credential
AGENTFORCE-SEC-03	🚨 Critical	Apex Entry Point Exposes or Mints Integration Tokens
AGENTFORCE-SEC-06	🔴 High	Hard-coded Authorization Header in Apex
AGENTFORCE-SEC-02	🔴 High	Secret Written to Debug Log
AGENTFORCE-VF-04	🔴 High	Visualforce Session ID Exposure
AGENTFORCE-AF-18	🔴 High	Clear-Text Agent Client Token in Mule Configuration
AGENTFORCE-AF-24	🔴 High	Credential Logged or Leaked by Java Agent Server
AGENTFORCE-SEC-04	🟡 Medium	Connected App With Full / Non-Expiring OAuth Access
AGENTFORCE-SEC-05	🟡 Medium	Secret Stored in Public or Unprotected Custom Metadata
AGENTFORCE-MCP-22	🟡 Medium	OAuth Token Stored With Open Permissions, Logged or Put in a URL

Custom Permission Enforcement

Rule ID	Severity	Name
AGENTFORCE-16.1	🔴 High	Agent Action Without Custom Permission Gate

Data Cloud Grounding

Rule ID	Severity	Name
AGENTFORCE-13.1	🚨 Critical	RAG Knowledge Source Without Schema Classification

Data Exfiltration

Rule ID	Severity	Name
AGENTFORCE-21.1	🚨 Critical	PII/PHI Payload Leakage in Tool Output
AGENTFORCE-35.1	🔴 High	SalesBleed: untrusted ingress + sensitive read + egress (lethal trifecta)
AGENTFORCE-35.2	🟡 Medium	SalesBleed: over-broad CSP Trusted Site / CORS origin

Data Exfiltration / Injection

Rule ID	Severity	Name
AGENTFORCE-21.2	🔴 High	Insecure Output Handling (Agent-to-XSS)

Einstein Copilot Studio Configuration

Rule ID	Severity	Name
AGENTFORCE-12.1	🚨 Critical	Latent Memory Poisoning in Prompt Template
AGENTFORCE-12.2	🟢 Low	GenAiPlannerBundle API Version Drift

Excessive Agency

Rule ID	Severity	Name
AGENTFORCE-1.1	🚨 Critical	Mandatory User Confirmation
AGENTFORCE-20.1	🚨 Critical	DML Bypassing FLS in Invocable Actions
AGENTFORCE-20.2	🚨 Critical	Unconstrained ModifyAllData in Agent Context
SNOW-20.2	🚨 Critical	Role Masking Not Configured for Dynamic User Agent
AGENTFORCE-1.4	🔴 High	Agent Write Without User Identity Binding
AGENTFORCE-MCP-21	🔴 High	Salesforce MCP Tool Runs Apex, Writes Code, DML or Permissions Without a Gate

External Service Security

Rule ID	Severity	Name
AGENTFORCE-15.2	🔴 High	Dynamic Cloaking via External RAG Source
AGENTFORCE-15.1	🔴 High	External Service Without Certificate Pinning

Governance

Rule ID	Severity	Name
AGENTFORCE-4.3	🔴 High	Synthetic Evaluation Completeness

Graph: Cascading Automation

Rule ID	Severity	Name
AGENTFORCE-32.1	🔴 High	Unintended Autonomous Blast Radius

Graph: Component Injection

Rule ID	Severity	Name
AGENTFORCE-34.1	🚨 Critical	Agent-to-UI XSS (Component Injection Graph)

Graph: MCP Identity Mismatch

Rule ID	Severity	Name
AGENTFORCE-33.1	🔴 High	MCP Over-Provisioning

Graph: PII Exfiltration Path

Rule ID	Severity	Name
AGENTFORCE-30.1	🚨 Critical	Context Window PII Poisoning (Graph)

Graph: Privilege Escalation Path

Rule ID	Severity	Name
AGENTFORCE-31.1	🚨 Critical	Autonomous Without-Sharing Escalation (Deep)

Grounding Security

Rule ID	Severity	Name
AGENTFORCE-3.1	🚨 Critical	Hardcoded Sensitive Indicators
AGENTFORCE-3.2	🚨 Critical	Field-Level Security Masking Alignment

Headless MCP Access

Rule ID	Severity	Name
AGENTFORCE-MCP-02	🚨 Critical	Broad Scope DevOps Pipeline Inheritance
AGENTFORCE-MCP-01	🚨 Critical	Token Passthrough Exposure Configuration
AGENTFORCE-MCP-04	🔴 High	MCP Tool Definition Drift (Rug Pull Detection)
AGENTFORCE-MCP-06	🔴 High	MCP Schema Parameter Injection
AGENTFORCE-MCP-03	🔴 High	Missing Protocol Scope Constraints
AGENTFORCE-MCP-05	🔴 High	Shadow MCP Server Detection
AGENTFORCE-MCP-07	🔴 High	MCP Server Network Exposure

Injection

Rule ID	Severity	Name
AGENTFORCE-25.1	🚨 Critical	Dynamic SOQL Injection
AGENTFORCE-25.2	🚨 Critical	Dynamic SOSL Injection
AGENTFORCE-FLOW-03	🔴 High	Variable Injection in DML
AGENTFORCE-25.7	🔴 High	Model-Controlled Query or Index Injection
AGENTFORCE-MCP-20	🔴 High	MCP Tool Argument Reaches a Network, File or Code-Execution Sink
AGENTFORCE-MCP-18	🟡 Medium	MCP Tool Input Inserted Into REST Path Without Validation

Instruction Integrity

Rule ID	Severity	Name
AGENTFORCE-9.1	🚨 Critical	Metadata Instruction Poisoning
AGENTFORCE-9.2	🔴 High	Cross-Topic Instruction Boundary

MCP Authentication

Rule ID	Severity	Name
AGENTFORCE-MCP-15	🔴 High	MCP Named Credential Without Authentication
AGENTFORCE-MCP-19	🔴 High	MCP OAuth Provider Skips redirect_uri or Client Checks
AGENTFORCE-24.2	🔴 High	Missing Signature Validation on Agent Webhook
AGENTFORCE-MCP-17	🟡 Medium	MCP Server Served Over HTTP Without Authentication

MCP Client Security

Rule ID	Severity	Name
AGENTFORCE-MCP-24	🚨 Critical	MCP Client Opens Server-Supplied Authorization URL Without Validation
AGENTFORCE-MCP-25	🚨 Critical	Unauthenticated MCP Proxy Spawns Request-Supplied Stdio Command

MCP Supply Chain

Rule ID	Severity	Name
AGENTFORCE-MCP-08	🚨 Critical	MCP Tool Description Poisoning
AGENTFORCE-MCP-09	🚨 Critical	MCP Server Hardcoded Secrets / PII
AGENTFORCE-MCP-10	🚨 Critical	MCP Tool Code Execution Sink
AGENTFORCE-MCP-14	🚨 Critical	MCP Dangerous Tool Capability
AGENTFORCE-MCP-11	🔴 High	MCP Tool Shadowing / Cross-Tool Hijack
AGENTFORCE-MCP-12	🔴 High	MCP Server Unrestricted Filesystem by Default
AGENTFORCE-MCP-13	🔴 High	MCP Tool Can Change Its Own Safety Configuration
AGENTFORCE-MCP-16	🔴 High	ServiceNow MCP Script or Any-Table Write Tool Without a Gate

MuleSoft Agent Fabric

Rule ID	Severity	Name
AGENTFORCE-AF-01	🚨 Critical	Broker PII Routing Without Guard
AGENTFORCE-AF-02	🔴 High	LLM Provider Without Rate Limit
AGENTFORCE-AF-03	🔴 High	A2A Card Overpermissioned Scope
AGENTFORCE-AF-04	🔴 High	Broker Privilege Escalation via Routing
AGENTFORCE-AF-06	🔴 High	Agent Fabric Broker Write Tool Without Approval
AGENTFORCE-AF-08	🔴 High	Agent Fabric Connection Without Authentication
AGENTFORCE-AF-09	🔴 High	Unauthenticated MCP / A2A Agent Endpoint
AGENTFORCE-AF-11	🔴 High	Agent Tool Writes to System of Record
AGENTFORCE-AF-15	🔴 High	Mule SSRF via Request-Controlled URL
AGENTFORCE-AF-16	🔴 High	Mule A2A Authorizer Allows Every Request
AGENTFORCE-AF-17	🔴 High	Write Tool on Unauthenticated Mule MCP Server
AGENTFORCE-AF-05	🟡 Medium	Bidirectional Agent Communication Without Broker
AGENTFORCE-AF-07	🟡 Medium	Agent Fabric Broker Unconstrained Autonomy
AGENTFORCE-AF-10	🟡 Medium	A2A Agent Card Without Security Scheme
AGENTFORCE-AF-12	🟡 Medium	Over-Broad Agent Fabric Registry Tool Access
AGENTFORCE-AF-14	🟡 Medium	Mule Outbound TLS Validation Disabled
AGENTFORCE-AF-13	🟢 Low	Agent Fabric Broker Without Rate-Limit Policy

Multi-Agent Orchestration

Rule ID	Severity	Name
AGENTFORCE-18.1	🚨 Critical	Compositional Fragment Trap Risk
AGENTFORCE-18.2	🔴 High	Sybil Identity in Multi-Agent Orchestration
SNOW-18.2	🔴 High	Yokohama Agent Duplication Sybil

Network Security

Rule ID	Severity	Name
AGENTFORCE-API-01	🔴 High	External Callout Injection
AGENTFORCE-AF-20	🔴 High	Caller-Controlled A2A Push-Notification URL

Open Redirect

Rule ID	Severity	Name
AGENTFORCE-VF-03	🟡 Medium	Visualforce Open Redirect

OpenGraph Security

Rule ID	Severity	Name
AGENTFORCE-OG-01	🔴 High	OGP Metadata Prompt Injection
AGENTFORCE-OG-03	🔴 High	Attractive Metadata Attack via OGP
AGENTFORCE-OG-02	🟡 Medium	A2A Agent Card / OGP Trust Mismatch

Operational Reliability

Rule ID	Severity	Name
AGENTFORCE-10.1	🟡 Medium	Validation Rule Conflict

Orchestration Integrity

Rule ID	Severity	Name
AGENTFORCE-4.1	🔴 High	Planner Orchestration Completeness

Platform Event Security

Rule ID	Severity	Name
AGENTFORCE-19.1	🚨 Critical	Sub-agent Spawning via Platform Event
AGENTFORCE-19.2	🔴 High	CDC Without Field Filter in Agent Context

Privilege Escalation

Rule ID	Severity	Name
AGENTFORCE-FLOW-01	🚨 Critical	System Context Enforcement
AGENTFORCE-1.3	🔴 High	Target Context Privilege Analysis

Prompt Injection

Rule ID	Severity	Name
AGENTFORCE-PT-01	🟡 Medium	Template Context Poisoning

Resource Exhaustion

Rule ID	Severity	Name
AGENTFORCE-23.1	🔴 High	Non-Selective SOQL in Agent Tools (Agent DoS)

Runtime Capability Drift

Rule ID	Severity	Name
AGENTFORCE-RD-01	🔴 High	Headless Confirmation Bypass (Experience Layer)
AGENTFORCE-RD-03	🔴 High	PII Output Bypass in Headless Transmissions
AGENTFORCE-RD-04	🔴 High	Headless PII Route Validation
AGENTFORCE-RD-02	🟡 Medium	Variable State Condition Evasion

SSRF

Rule ID	Severity	Name
AGENTFORCE-22.1	🚨 Critical	Unsafe Autonomous HTTP Callouts

Secrets Exposure

Rule ID	Severity	Name
AGENTFORCE-MULE-01	🚨 Critical	MuleSoft Plaintext Secret in Secure Config

Security Configuration

Rule ID	Severity	Name
AGENTFORCE-PT-02	🔴 High	Experimental Template Activation Exposure

ServiceNow ACL

Rule ID	Severity	Name
SNOW-28.1	🚨 Critical	ACL Script Using GlideRecord (Recursive Bypass)
SNOW-28.6	🔴 High	addEncodedQuery Without User Context Restriction

ServiceNow API Authentication

Rule ID	Severity	Name
SNOW-24.1	🔴 High	Agent API Endpoint Without OAuth Scope Validation

ServiceNow Action Fabric

Rule ID	Severity	Name
SNOW-AF-06	🔴 High	Inline Agent Tool Script Without Record ACL
SNOW-AF-08	🔴 High	Unauthenticated Agent MCP Client Connection
SNOW-AF-09	🔴 High	Public or Unauthenticated Action Fabric Endpoint
SNOW-AF-11	🔴 High	Agent Tool Can Change a System of Record
SNOW-AF-14	🔴 High	Agent Writes HTML or [code] Markup Into Work Notes
SNOW-AF-10	🟡 Medium	A2A Agent Card Without a Security Scheme
SNOW-AF-13	🟢 Low	Autopilot Tool Without an Execution Cap

ServiceNow Agent Architecture

Rule ID	Severity	Name
SNOW-7.1	🟡 Medium	Agent Instruction Bloat

ServiceNow Autonomous Scheduling

Rule ID	Severity	Name
SNOW-11.1	🔴 High	Scheduled Job Invoking Agent Without Guardrail

ServiceNow Data Exfiltration

Rule ID	Severity	Name
SNOW-21.1	🚨 Critical	Agent Script Accessing Sensitive Table Without Privacy Guard

ServiceNow Data Privacy

Rule ID	Severity	Name
SNOW-13.1	🔴 High	Agent Accessing Classified Data Without Privacy Guard

ServiceNow Domain Separation

Rule ID	Severity	Name
SNOW-29.1	🔴 High	Domain Separation Drift (Missing sys_domain)

ServiceNow Excessive Agency

Rule ID	Severity	Name
SNOW-20.3	🚨 Critical	Agent runAs Falls Back to System Administrator
SNOW-20.1	🚨 Critical	Agent Executing With Admin Privileges

ServiceNow External Service

Rule ID	Severity	Name
SNOW-15.1	🔴 High	Integration Spoke Without Certificate Pinning

ServiceNow Flow Security

Rule ID	Severity	Name
SNOW-5.1	🔴 High	Flow Action Without Input Validation

ServiceNow Grounding Security

Rule ID	Severity	Name
SNOW-3.1	🔴 High	Grounding Source Without Classification

ServiceNow Instruction Integrity

Rule ID	Severity	Name
SNOW-9.1	🚨 Critical	Prompt Injection Vector in Agent Instructions

ServiceNow MCP Access

Rule ID	Severity	Name
SNOW-25.1	🔴 High	MCP Server Without Scope Constraints

ServiceNow MID Server Trust

Rule ID	Severity	Name
SNOW-31.1	🚨 Critical	MID Server / Discovery Trust Violation

ServiceNow Memory Safety

Rule ID	Severity	Name
SNOW-12.2	🚨 Critical	Latent Memory Poisoning in Agent Memory

ServiceNow Multi-Agent

Rule ID	Severity	Name
SNOW-18.1	🔴 High	Multi-Agent Compositional Fragment Trap

ServiceNow Operational Reliability

Rule ID	Severity	Name
SNOW-10.1	🔴 High	Agent DML Without Data Policy Guard

ServiceNow Resource Exhaustion

Rule ID	Severity	Name
SNOW-23.1	🔴 High	Unbounded GlideRecord Query in Agent Script

ServiceNow Role-Based Access

Rule ID	Severity	Name
SNOW-16.1	🔴 High	Agent Action Without Role Gate

ServiceNow Runtime Drift

Rule ID	Severity	Name
SNOW-27.1	🚨 Critical	Now Assist API Confirmation Bypass

ServiceNow SSRF

Rule ID	Severity	Name
SNOW-22.1	🚨 Critical	SSRF via Dynamic RESTMessageV2 Endpoint

ServiceNow Scope Hygiene

Rule ID	Severity	Name
SNOW-30.1	🔴 High	Application Scope Hygiene Violation

ServiceNow Script Safety

Rule ID	Severity	Name
SNOW-2.1	🚨 Critical	Unsafe Script Pattern in Agent Tool

ServiceNow Skill Kit

Rule ID	Severity	Name
SNOW-12.1	🔴 High	Skill Kit Version Drift

ServiceNow Structural Dependency

Rule ID	Severity	Name
SNOW-4.1	🔴 High	Orphaned Agent Tool Reference

ServiceNow Supply Chain

Rule ID	Severity	Name
SNOW-6.1	🔴 High	Update Set Missing Agent Dependencies
SNOW-26.1	🔴 High	Skill Namespace Shadowing

ServiceNow Tool Configuration

Rule ID	Severity	Name
SNOW-1.1	🚨 Critical	Agent Tool Without Confirmation Gate

ServiceNow Trigger Execution

Rule ID	Severity	Name
SNOW-19.1	🔴 High	Business Rule Triggering Agent Execution

ServiceNow Virtual Agent

Rule ID	Severity	Name
SNOW-14.1	🔴 High	Virtual Agent Topic Without Input Sanitization

Slack Integration Security

Rule ID	Severity	Name
AGENTFORCE-14.1	🔴 High	Slack Channel Bot Without DLP Guard

Structural Dependency

Rule ID	Severity	Name
AGENTFORCE-4.2	🔴 High	Component Deactivation Collision

Supply Chain Security

Rule ID	Severity	Name
AGENTFORCE-SC-02	🔴 High	Silent Schema Desync Exploit
AGENTFORCE-SC-03	🟡 Medium	Managed Package Origin
AGENTFORCE-SC-01	🟢 Low	Agent Metadata Below API v64

Supply Chain: ToxicSkills

Rule ID	Severity	Name
AGENTFORCE-TS-01	🚨 Critical	Hidden Instruction in Markdown
AGENTFORCE-TS-02	🔴 High	Base64 Payload in Skill File
AGENTFORCE-TS-03	🔴 High	Zero-Width Unicode Injection

Unauthorized Action

Rule ID	Severity	Name
AGENTFORCE-FLOW-02	🔴 High	Silent State Modification via Flow

XSS

Rule ID	Severity	Name
AGENTFORCE-VF-01	🚨 Critical	Visualforce XSS via escape=false

XXE / SSRF

Rule ID	Severity	Name
AGENTFORCE-25.5	🔴 High	Unsafe XML / SSRF via Dom.Document