dx-code-analyzer-run
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses helper scripts (describe-rule.js, list-rules.js) that invoke the Salesforce CLI via child_process.execSync. This is standard behavior for wrapping CLI tool functionality.- [DYNAMIC_EXECUTION]: The apply-fixes.js script modifies local source files in-place based on transformations provided in the scan output. This capability is gated by user confirmation in the skill workflow.- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data (scan results JSON and project source files). Ingestion points: scripts/parse-results.js, scripts/apply-fixes.js, scripts/filter-violations.js. Boundary markers: None. Capability inventory: File write (fs.writeFileSync), Command execution (execSync). Sanitization: scripts/list-rules.js includes a whitelist for rule selector tokens.- [SAFE]: No malicious patterns, obfuscation, or unauthorized data exfiltration were detected. The skill originates from a trusted author (Salesforce) and serves a legitimate purpose for development workflows.
Audit Metadata