The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a data pipeline where the Agentforce planner generates JSON payloads (the Details input) which are then processed by a Flow and rendered by an LWC. This architecture creates an ingestion surface for indirect prompt injection if user-supplied data influenced by the planner is not strictly sanitized.\n
Ingestion points: Details input in the GenAiFunction (templates/genai-function/input/schema.json) and the value property in the LWC (templates/clt-lwc-template.js).\n
Boundary markers: The skill advises using explicit JSON blocks in instructions and implementing validation logic within a __normalizeViewModel function in the LWC.\n
Capability inventory: Metadata deployment via sf project deploy and permission modification via sf apex run using an anonymous Apex script.\n
Sanitization: Uses a SUBSTITUTE formula in the Flow (templates/clt-flow-meta.xml) to handle escaped characters and coercion logic in the LWC template.\n- [COMMAND_EXECUTION]: The skill provides instructions for executing command-line operations using the Salesforce CLI (sf), including sf project deploy start for pushing code and sf apex run for executing server-side scripts.\n- [PRIVILEGE_ESCALATION]: The grant-guest-perms.apex template enables the programmatic insertion of SetupEntityAccess records. This script is designed to grant the Site Guest User access to specific Apex classes, which expands the org's attack surface to facilitate guest chat capabilities.\n- [DYNAMIC_EXECUTION]: The LWC template (templates/clt-lwc-template.js) performs JSON.parse() on the value property at runtime. The skill also references an external 'CLT Builder' tool on Heroku that generates and deploys metadata to the Salesforce environment.\n- [EXTERNAL_DOWNLOADS]: The skill directs users to an external 'CLT Builder' accelerator hosted on Heroku (agentforce-clt-builder-e4e03ec84f1a.herokuapp.com). While Heroku is a well-known hosting service, the use of external code-generation tools introduces third-party dependencies into the development lifecycle.

generating-clt-components