The Agent Skills Directory

[PROMPT_INJECTION]: The skill ingests and analyzes user-provided JavaScript and HTML source files to identify compliance issues. This creates a potential surface for indirect prompt injection where instructions hidden within the source code could attempt to influence the agent's behavior.
Ingestion points: JavaScript, TypeScript, and HTML files within the LWC component bundle are read and processed.
Boundary markers: The instructions do not specify the use of delimiters or specific system instructions to ignore embedded commands within the analyzed source code.
Capability inventory: The skill possesses the capability to execute a shell script (scripts/run-komaci.sh) and use its output to generate a report.
Sanitization: No explicit sanitization or content filtering is performed on the ingested files before analysis.
[COMMAND_EXECUTION]: The skill executes a shell script (scripts/run-komaci.sh) to run the Komaci static analyzer. The script correctly quotes user-supplied paths to mitigate command injection risks. It also allows for the optional override of the linter binary via the KOMACI_ESLINT_BIN environment variable.
[EXTERNAL_DOWNLOADS]: The skill's runner script installs necessary Node.js dependencies (eslint and @salesforce/eslint-plugin-lwc-graph-analyzer) from the official npm registry during its first run. These dependencies are pinned in scripts/package.json and originate from a trusted organization.

mobile-platform-offline-validate