platform-widget-generate
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is authored by 'forcedotcom' (Salesforce) and operates within the expected domain of Salesforce development. It manages the generation of .json, .xml, and schema files for UI widgets.
- [COMMAND_EXECUTION]: The skill includes a specific security rule prohibiting the use of subshells, backticks, or evaluation commands (e.g.,
eval,exec) in bash tool calls. This is a strong defensive measure against command injection during the file writing phase. - [DATA_EXPOSURE]: The skill reads project metadata (specifically Apex class files) to derive data shapes. This is a legitimate functional requirement for generating correctly typed widget schemas and does not involve unauthorized data access.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user (such as pasted JSON or field lists) to infer widget shapes. While this represents a potential injection surface, the skill implements a rigid mapping process to primitive Salesforce types and includes a self-validation checklist to ensure output integrity, which mitigates the risk of generating malicious configuration.
Audit Metadata