platform-custom-lightning-type-generate
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of user requirements to generate Salesforce metadata files and shell commands, creating a potential surface for prompt injection via the tool-generation pipeline. 1. Ingestion points: User instructions for creating Custom Lightning Types as defined in SKILL.md. 2. Boundary markers: The instructions mandate strict JSON schema validation using the unevaluatedProperties keyword set to false. 3. Capability inventory: The skill provides logic for the agent to emit Bash tool calls for file and directory management. 4. Sanitization: The skill contains explicit safety instructions for the agent to avoid shell metacharacters (e.g., command substitution, eval) and disallowed JSON keywords to prevent injection and validation errors.
- [PROMPT_INJECTION]: The skill includes directives for the agent to alter the syntax of its shell commands specifically to avoid triggering manual approval filters in the 'Vibes' platform environment. This behavior modification is designed to circumvent syntax-based security oversight for workflow optimization.
Audit Metadata