experience-lwc-generate
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto execute the official Salesforce SLDS linter (@salesforce-ux/slds-linter) vianpxinscripts/slds_linter_wrapper.py. This is an intended function for code validation and utilizes vendor-provided tooling to score component quality. - [INDIRECT_PROMPT_INJECTION]: The skill includes validation hooks (
scripts/post-tool-validate.py) that parse LWC templates and controllers. While this logic processes untrusted component code, the analysis is limited to static regex checks and official linting, with no interpretation or execution of the code's logic. - [EXTERNAL_DOWNLOADS]: Documentation and scripts reference official Salesforce development packages and utilities (e.g.,
@salesforce/sfdx-lwc-jest,@salesforce/lwc-language-server) from the npm registry. These resources originate from a well-known service provider and are standard dependencies for the LWC development ecosystem.
Audit Metadata