---
name: salesforce-org-discovery
description: Map a Salesforce org you did not build. Use at the start of work in a client org, before changing any field, object, Flow, Apex class or permission.
---

<!-- Status: DRAFT, NOT APPROVED. Check the skill folder layout and header fields against Anthropic's current Claude Code documentation before relying on it. -->

# Salesforce org discovery

Discovery only. Do not edit, deploy or delete anything while this skill is running. The one file you may create or append to is `DISCOVERY.md`, the discovery log. Write nowhere else.

## 1. Confirm where you are
1. Run `sf org list`. Say which alias you will use and ask me to confirm it is the sandbox.
2. If the alias is production, stop.
3. Put `--target-org <alias>` on every command from here on.

## 2. Count the moving parts
Counts and names only. No record contents.
1. Active users by profile.
2. Custom objects.
3. Active Flows by process type and trigger type.
4. Apex classes and triggers in the org's own namespace.
5. Validation rules, Workflow Rules and active Process Builder processes.
Use the queries in `queries.md` if it is in the project. Record each command in `DISCOVERY.md`.

## 3. List automation by object
1. For each object with the most automation, list its Flows, triggers, Workflow Rules and validation rules.
2. Note any object where more than one automation type writes the same field.
3. Say where run order is unknown.

## 4. List code on the busiest objects
1. List the Apex classes and triggers that reference those objects.
2. Flag dynamic Apex (string field names, dynamic SOQL) as a place a text search can miss.
3. Note test classes that set fields directly.

## 5. Snapshot access
1. List permission sets and profiles that grant Modify All Data or View All Data. Do not change them.
2. List users whose last login is oldest, and API-only or integration users.

## 6. List what connects to the outside
Connected apps, named credentials, outbound messages, platform event and change data capture subscribers. For each, name who on the client team could explain it.

## 7. Write the one-page summary
Return:
- What the org contains (the counts).
- Where the logic lives (the busiest objects).
- Who has broad access.
- What connects to outside systems.
- What is unknown.
- Three questions to ask the client before we change anything.
- "Not checked": what you did not look at and why.

Every finding needs: what touches it, how sure you are, and how to check it. If you cannot prove something is unused, write "unknown".