Agent skill · forcedotcom
experience-lwc-security-validate
Use this skill as THE specialized Lightning Web Security (LWS) validator for a Lightning Web Component bundle (`.js`, `.ts`, `.html`, `.css`, `.js-meta.xml`) — the canonical LWS/Product-Security review for LWCs, NOT a generic code-security pass. It produces either a severity-ranked finding list with code-level remediations or a SARIF 2.1.0 JSON score report keyed by the `lws-001`…`lws-023b` rule catalog. TRIGGER when the user asks to review, audit, or check an LWC component for LWS compliance issues and recommend fixes, score a component's LWS/security compliance, find dangerous DOM APIs or blocked sinks (`eval`, `Function`, `document.write`, `innerHTML`, `document.createElement('script')`, global-scope assignment to `window`/`globalThis`, unsafe URL schemes), or emit a SARIF security report. DO NOT TRIGGER for generic non-LWC security review, for building a new LWC (use experience-lwc-generate), accessibility (WCAG 2.2), RTL/i18n, or Apex/Aura/server-side review.
What it needs
About 6k tokens when loaded.
What this skill does
<!-- adk-managed-skill --> Reviewing LWS Security Run a structured Lightning Web Security (LWS) and Product Security compliance pass over a Lightning Web Component. Two output modes: Review mode (default) — severity-ranked findings + applied code fixes. Score mode — SARIF 2.1.0 JSON report keyed by the LWS rule catalog (lws-001…lws-023b) for downstream gating, eval scoring, or CI ingest. Both modes use the same detection rules from the references; only the output format differs. When to Use The user asks for a "security review", "LWS check", "pre-ship security audit", or "compliance pass" on a specific LWC → review mode. The user asks to "score" a component's security or wants machine-readable findings to feed a gate or eval → score mode. Preparing a component for release and needing a unified security report. After implementing a fix, to verify no regression in security posture. Do NOT use this skill for: Building new components (use experience-lwc-generate). Accessibility (apply WCAG 2.2 separately) or RTL review — out of scope. Gating a fix behind a feature flag (apply feature-flag gating after fixes land). Non-LWC security review (Apex, Aura, server-side) — out of scope. Prerequisites Component path (LWC bundle under modules/…). Access to the component's JS/TS, HTML templates, CSS, and .js-meta.xml. Output mode: review (default — find, fix, report) or score (find, emit SARIF JSON, do NOT modify code). Confirm with the user before starting if it isn't obvious from the request. Knowledge Bases Each reference is the source of truth. Do not summarize from memory — open the reference, apply the guidelines, and cite the specific section you used in the report. Lightning Web Security (LWS) catalog: LWS Security Expert — blocked APIs and allowed alternatives. Rule catalog (lws-001…lws-023b): Product Security Framework — for every rule the catalog gives the detection patterns and the canonical SARIF ruleId / level / message template. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills forcedotcom/experience-lwc-security-validate--27a64e