When you install a plugin with the sf plugins install command, Salesforce CLI first verifies its digital signature. If the plugin provides a valid signature, the CLI installs it. Otherwise, Salesforce CLI doesn’t install it until you answer a warning prompt and acknowledge that you understand the risks. This process works well when you install a plugin interactively at the command line, but can prevent a batch job from completing. To automatically install a plugin without prompting, even when unsigned, create an allowlist file on your local file system and add the plugins you trust.
After you install a plugin and run one of its commands in a terminal, the command runs with your user privileges. As a result, the command can read encrypted data, communicate with any Salesforce org you authenticated to, or remove files in your home directory. Install only unsigned and unverified plugins that you trust.
Note
Create a file called unsignedPluginAllowList.json and put it in one of these directories:
Add the names of the plugins you trust to the JSON file in a simple array of strings. For example:
1[
2 "sfdx-templates",
3 "salesforce-cmdt",
4 ...
5]
j