The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local project environment, which could potentially contain malicious instructions.
Ingestion points: The skill reads and parses sfdx-project.json and scans the local directory tree using the scripts/find-bundle-package-dir.sh script.
Boundary markers: No explicit delimiters or instructions are used to separate untrusted file content from the agent's internal instructions.
Capability inventory: The skill has the ability to execute Salesforce CLI (sf) commands, perform file system writes (metadata files), and run npm commands.
Sanitization: There is no evidence of validation or sanitization of inputs retrieved from the project configuration before they are used in command construction.
[COMMAND_EXECUTION]: The skill executes npm install and npm run build within the bundle directory. While these are standard development tasks, they involve executing third-party scripts defined in a local package.json file.
[DYNAMIC_EXECUTION]: The skill utilizes node -e one-liners to programmatically modify sfdx-project.json. This involves executing strings as JavaScript code to perform configuration updates.

experience-ui-bundle-2gp-deploy