OverviewHistoryStatsSecurity
npx skills add ...
Documentation
SKILL.md
npx skills add forcedotcom/sf-skills --skill experience-lwc-security-validate
Use this skill as THE specialized Lightning Web Security (LWS) validator for a Lightning Web Component bundle (`.js`, `.ts`, `.html`, `.css`, `.js-meta.xml`) — the canonical LWS/Product-Security review for LWCs, NOT a generic code-security pass. It produces either a severity-ranked finding list with code-level remediations or a SARIF 2.1.0 JSON score report keyed by the `lws-001`…`lws-023b` rule catalog. TRIGGER when the user asks to review, audit, or check an LWC component for LWS compliance issues and recommend fixes, score a component's LWS/security compliance, find dangerous DOM APIs or blocked sinks (`eval`, `Function`, `document.write`, `innerHTML`, `document.createElement('script')`, global-scope assignment to `window`/`globalThis`, unsafe URL schemes), or emit a SARIF security report. DO NOT TRIGGER for generic non-LWC security review, for building a new LWC (use experience-lwc-generate), accessibility (WCAG 2.2), RTL/i18n, or Apex/Aura/server-side review.
npx skills add forcedotcom/sf-skills --skill experience-lwc-security-validate
Run a structured Lightning Web Security (LWS) and Product Security compliance pass over a Lightning Web Component. Two output modes:
lws-001…lws-023b) for downstream gating, eval scoring, or CI ingest.Both modes use the same detection rules from the references; only the output format differs.
Do NOT use this skill for:
experience-lwc-generate).modules/…)..js-meta.xml.review (default — find, fix, report) or score (find, emit SARIF JSON, do NOT modify code). Confirm with the user before starting if it isn't obvious from the request.Each reference is the source of truth. Do not summarize from memory — open the reference, apply the guidelines, and cite the specific section you used in the report.
lws-001…lws-023b): Product Security Framework — for every rule the catalog gives the detection patterns and the canonical SARIF ruleId / level / message template. Score mode emits one SARIF result per match using these exact values.Collect the component path and identify the files to review. Include every file in the component bundle: .html, .js/.ts, .css, .js-meta.xml, and any child components owned by the same team that are invoked from the target.
Note any existing feature-flag gates — findings that require code changes must respect them.
Read LWS Security Expert and Product Security Framework top-to-bottom before judging. The LWS reference enumerates blocked DOM APIs and their allowed alternatives; the Product Security framework gives the severity taxonomy, the 23-rule SARIF catalog, and remediation patterns.
Run every rule in Product Security Framework (lws-001 through lws-023b) against the component bundle. For each rule:
Reflect.*, string concatenation) you must consider.ruleId, level (error / warning from the catalog), file, startLine, startColumn (column 1 if unknown), message (use the catalog's message template, substituting any {placeholder} from the actual code).scripts/check-lwc-import.sh <file> — the script prints lwc-import=yes when a from 'lwc' import is present and lwc-import=no otherwise. Skip the rule for that file when the answer is no.This catalog is the canonical detection list; the JS/TS, HTML, and .js-meta.xml bullets that follow are additional checks beyond the SARIF rules.
Walk each template for:
lwc:inner-html usage — verify the source is trusted.href, src, srcdoc, inline event handlers).style="…" with bound expressions — candidates for CSS class swaps.<iframe> or <object> without sandboxing (Step 3 catches the srcdoc and protocol cases via lws-023a/lws-023b; this step catches missing sandbox attributes).Inspect .js-meta.xml for:
lightning__FlowScreen, lightning__AppPage, etc.) when the component doesn't need it.capabilities restrictions for the target surface.Inspect Apex bindings for:
@wire to Apex methods without @AuraEnabled(cacheable=true) where caching is safe.Findings from Steps 4-5 use rule IDs lws-tpl-001…lws-tpl-NNN (HTML) and lws-meta-001…lws-meta-NNN (meta) — sequence numbers per finding within the report — so they don't collide with the SARIF catalog.
Pick the output format based on the mode confirmed in Prerequisites.
Use examples/review-report.md as the template — one bullet per finding under ## Security (LWS + Product), one totals line under ## Summary.
Severity ordering: Critical → High → Medium → Low (map SARIF error → High, warning → Medium unless the rule says otherwise). Cite the reference section that produced each finding (e.g., "Product Security § lws-001 document.createProcessingInstruction").
Emit a single SARIF 2.1.0 JSON document — and nothing else. No prose before or after. Do NOT write the JSON to a file; return it inline. Empty results array means no issues found.
Use examples/score-report.sarif.json as the shape reference — same top-level structure ($schema, version, runs[0].tool.driver.rules[], runs[0].results[]), populated with the actual rules that fired and the actual matches.
Rules:
ruleId matches a catalog entry exactly (lws-001…lws-023b, or the lws-tpl-* / lws-meta-* namespaces from Steps 4-5).level is error for catalog rules marked level: error and warning for level: warning. No other values.message.text uses the catalog's message template with placeholders substituted (e.g., replace {eventName} with the actual event name found in code).result per match. If a rule fires three times in a file, emit three results.tool.driver.rules; an empty results array still requires tool.driver.rules to be present (use []).Skip in score mode — score mode is read-only.
For each accepted finding:
scripts/validate-sarif.sh <path> — the script confirms the JSON parses, version is 2.1.0, every ruleId matches the catalog pattern (lws-NNN[a-z]? / lws-tpl-NNN / lws-meta-NNN) and is declared in tool.driver.rules, every level is error or warning, and every result has a physicalLocation.artifactLocation.uri + region.startLine. Fix any failure before returning the SARIF.experience-lwc-generate — for authoring new LWC bundles that are security-compliant from the start.design-systems-slds-validate — SLDS/design-system compliance pass (accessibility overlaps with WCAG 2.2 — run separately).dx-code-analyzer-run — repo-wide static-analysis pass; use it alongside this skill for coverage beyond the LWS catalog.lws-001…lws-023b) was evaluated against the bundle, not a hand-curated subset.