experience-lwc-runtime-observe
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local commands using the Salesforce CLI (
sf) and Python3 for DOM processing. These are standard developer tools required for the skill's primary purpose of Salesforce development. - [DATA_EXPOSURE]: The skill demonstrates high security awareness regarding authentication tokens. It explicitly forbids the agent from running
sf org opendirectly (which would leak a session token to the chat history). Instead, it usesscripts/open-frontdoor.shto capture the token into achmod 600(user-only) temporary file, which is then consumed by the browser driver and deleted immediately. - [REMOTE_CODE_EXECUTION]: No external code is downloaded or executed. All logic is contained within the bundled shell and Python scripts provided in the skill package.
- [PROMPT_INJECTION]: No malicious prompt injection patterns or attempts to override system safety guidelines were detected in the instructions.
Audit Metadata