experience-ui-bundle-deploy
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill automates the Salesforce development lifecycle using the official
sfCLI for authentication, deployment, and permission management. - [EXTERNAL_DOWNLOADS]: Standard build operations involve fetching JavaScript dependencies from the NPM registry using
npm installwithin the project's UI bundle directories. - [COMMAND_EXECUTION]: Deployment logic includes the execution of generated Anonymous Apex scripts and local Node.js scripts to perform data cleansing, record importing, and unique field preparation.
- [COMMAND_EXECUTION]: The skill uses
jqto parse project configuration files and dynamically resolve source paths for metadata operations. - [INDIRECT_PROMPT_INJECTION]: While the skill ingests untrusted project files like
data-plan.jsonandorg-setup.config.jsonfor script interpolation, it provides robust sanitization guidance, including mandatory regex validation (^[A-Za-z0-9_]+$) for API names and escaping rules for string literals to prevent injection into Apex or shell contexts.
Audit Metadata