deploying-ui-bundle
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill automates several CLI-based tasks, including UI bundle builds, metadata deployments, and permission set assignments using standard Salesforce development tools.
- [EXTERNAL_DOWNLOADS]: The 'Pre-deploy UI Bundle Build' step involves installing project dependencies, which typically involves fetching packages from external registries such as npm.
- [REMOTE_CODE_EXECUTION]: The skill utilizes 'Anonymous Apex' for data operations (Step 5) and triggers dependency installation, both of which involve executing code within the deployment environment.
- [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes project-specific files.
- Ingestion points:
sfdx-project.json,package.xml,data-plan.json, and*.uibundle-meta.xml. - Boundary markers: Absent; no specific delimiters are defined to isolate untrusted content.
- Capability inventory: Includes shell command execution (npm/sfdx), metadata deployment, and Anonymous Apex execution.
- Sanitization: Not explicitly implemented in the instructions for handling external project metadata.
Audit Metadata