sf-lwc
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill incorporates the use of the Salesforce CLI (
sf) and Node.js (npm) within its documented workflow to deploy components and execute Jest tests. - [INDIRECT_PROMPT_INJECTION]: The skill generates code based on user specifications, which constitutes a vulnerability surface for processing untrusted data.
- Ingestion points: User requirements for LWC scaffolding as defined in
SKILL.md. - Boundary markers: Absent; the instructions do not provide delimiters or safety warnings for user-provided data.
- Capability inventory: File system modification (
Write) and shell command execution (Bash(sf *),Bash(npm *)) as defined in the skill workflow. - Sanitization: Absent; user input is directly used to influence the generated component code.
- [DYNAMIC_EXECUTION]: The skill references patterns for runtime code loading, such as dynamic component imports and loading external libraries from static resources.
- Evidence:
references/lwc-patterns.mddetails the usage ofimport()for dynamic components andloadScript()for third-party libraries.
Audit Metadata