The Agent Skills Directory

[SAFE]: The skill is a security auditing tool designed for Lightning Web Components (LWC). It follows a structured workflow to identify vulnerabilities such as XSS, XML injection, and CSP bypasses based on the Lightning Web Security (LWS) framework.
[COMMAND_EXECUTION]: The skill includes two local helper scripts: scripts/check-lwc-import.sh and scripts/validate-sarif.sh. These scripts are used to perform lexical analysis of component imports and to validate the structure of generated SARIF security reports. The scripts utilize python3 and jq as declared in the skill metadata.
[DATA_EXPOSURE]: The skill reads component source code (JS, TS, HTML, CSS, XML) to identify security flaws. This access is necessary for its stated purpose and the data remains within the local environment. There are no instructions or scripts that attempt to access sensitive system files (e.g., SSH keys, AWS credentials).
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (LWC source files) and has the capability to modify these files. While this creates a theoretical surface for indirect prompt injection if the audited files contain instructions targeting the LLM, the skill's strict adherence to a predefined rule catalog and the requirement to cite specific knowledge base sections mitigate this risk. In accordance with security guidelines, this surface is noted but does not escalate the verdict.
[REMOTE_CODE_EXECUTION]: No remote code execution patterns were identified. The skill does not perform network requests and does not download or install external packages during operation.

experience-lwc-security-validate