experience-ui-bundle-2gp-deploy
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
sf(Salesforce CLI) andnodeto automate project configuration and deployment tasks. These are standard operations for Salesforce development. - [COMMAND_EXECUTION]: A helper script (
find-bundle-package-dir.sh) usesfind,grep, andjqto resolve project directory paths locally. These operations are scoped to the local project structure and do not involve network operations or sensitive data access beyond identifying folder locations. - [REMOTE_CODE_EXECUTION]: While the skill uses
npm installandnpm run build, these are standard development workflows for building UI applications. The dependencies are managed by the user's project, and no specific untrusted packages are introduced by the skill instructions. - [DATA_EXPOSURE]: The skill accesses
sfdx-project.jsonand standard Salesforce metadata directories (force-app/main/default). This is necessary for packaging operations and does not expose sensitive credentials. The skill explicitly advises using Salesforce's own permission sets and Dev Hub security toggles for access control.
Audit Metadata