experience-lwc-widget-migrate
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided or project-existing Lightning Web Components (LWC), creating a surface where malicious instructions embedded in the LWC code or its metadata could influence the agent's behavior.
- Ingestion points: The skill reads and assesses LWC components, their action outputs, and associated metadata (e.g.,
renderer.json) as described in sections 1 and 2. - Boundary markers: No explicit delimiters or instructions to ignore embedded natural language commands within the processed LWC source code are provided in this file.
- Capability inventory: The skill utilizes the
execute_metadata_actiontool and leverages referenced skills (platform-widget-generate,platform-lightning-type-widget-coordinate) to perform file system modifications and metadata updates. - Sanitization: There are no explicit sanitization steps mentioned for the input code; the skill relies on the downstream generation tools for self-validation.
Audit Metadata