experience-lwc-security-validate

<!-- adk-managed-skill -- Reviewing LWS Security Run a structured Lightning Web Security (LWS) and Product Security compliance pass over a Lightning Web Component. Two output modes: - Review mode (default) — severity-ranked findings + applied code fixes. - Score mode — SARIF 2.1.0 JSON report keyed by the LWS rule catalog ( … ) for downstream gating, eval scoring, or CI ingest. Both modes use the same detection rules from the references; only the output format differs. When to Use - The user asks for a "security review", "LWS check", "pre-ship security audit", or "compliance pass" on a specif…

\n\n# 3-6. Walk results[]\nresult_count=$(jq -r '.runs[0].results | length' \"$sarif\" 2>/dev/null || echo 0)\nif [ \"$result_count\" -eq 0 ]; then\n # Empty results array is legal (no findings) once results and\n # tool.driver.rules are both confirmed to be arrays above.\n if [ \"$status\" -eq 0 ]; then\n echo \"sarif-validate=ok results=0\"\n fi\n exit \"$status\"\nfi\n\nfor i in $(seq 0 $((result_count - 1))); do\n rid=$(jq -r \".runs[0].results[$i].ruleId // empty\" \"$sarif\")\n lvl=$(jq -r \".runs[0].results[$i].level // empty\" \"$sarif\")\n uri=$(jq -r \".runs[0].results[$i].locations[0].physicalLocation.artifactLocation.uri // empty\" \"$sarif\")\n line=$(jq -r \".runs[0].results[$i].locations[0].physicalLocation.region.startLine // empty\" \"$sarif\")\n\n if ! echo \"$rid\" | grep -Eq \"$rule_re\"; then\n echo \"result[$i].ruleId=fail found='$rid' reason=off-catalog-pattern\" >&2\n status=1\n elif ! echo \"$declared\" | grep -Fxq \"$rid\"; then\n echo \"result[$i].ruleId=fail found='$rid' reason=not-declared-in-tool.driver.rules\" >&2\n status=1\n fi\n\n case \"$lvl\" in\n error|warning) ;;\n *)\n echo \"result[$i].level=fail found='$lvl' reason=must-be-error-or-warning\" >&2\n status=1\n ;;\n esac\n\n if [ -z \"$uri\" ]; then\n echo \"result[$i].physicalLocation.artifactLocation.uri=fail reason=missing\" >&2\n status=1\n fi\n\n if [ -z \"$line\" ]; then\n echo \"result[$i].physicalLocation.region.startLine=fail reason=missing\" >&2\n status=1\n fi\ndone\n\nif [ \"$status\" -eq 0 ]; then\n echo \"sarif-validate=ok results=$result_count\"\nfi\n\nexit \"$status\"\n","content_type":"application/x-sh; charset=utf-8","language":"bash","size":4328,"content_sha256":"1ba9e66e1698bab871d6654a21d25a9004e452fec726ad9ee0fa16685669ae64"}],"content_json":{"type":"doc","content":[{"type":"paragraph","content":[{"text":"\u003c!-- adk-managed-skill -->","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Reviewing LWS Security","type":"text"}]},{"type":"paragraph","content":[{"text":"Run a structured Lightning Web Security (LWS) and Product Security compliance pass over a Lightning Web Component. Two output modes:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Review mode","type":"text","marks":[{"type":"strong"}]},{"text":" (default) — severity-ranked findings + applied code fixes.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Score mode","type":"text","marks":[{"type":"strong"}]},{"text":" — SARIF 2.1.0 JSON report keyed by the LWS rule catalog (","type":"text"},{"text":"lws-001","type":"text","marks":[{"type":"code_inline"}]},{"text":"…","type":"text"},{"text":"lws-023b","type":"text","marks":[{"type":"code_inline"}]},{"text":") for downstream gating, eval scoring, or CI ingest.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Both modes use the same detection rules from the references; only the output format differs.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"When to Use","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"The user asks for a \"security review\", \"LWS check\", \"pre-ship security audit\", or \"compliance pass\" on a specific LWC → review mode.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"The user asks to \"score\" a component's security or wants machine-readable findings to feed a gate or eval → score mode.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Preparing a component for release and needing a unified security report.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"After implementing a fix, to verify no regression in security posture.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Do NOT use this skill for:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Building new components (use ","type":"text"},{"text":"experience-lwc-generate","type":"text","marks":[{"type":"code_inline"}]},{"text":").","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Accessibility (apply WCAG 2.2 separately) or RTL review — out of scope.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Gating a fix behind a feature flag (apply feature-flag gating after fixes land).","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Non-LWC security review (Apex, Aura, server-side) — out of scope.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Prerequisites","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Component path (LWC bundle under ","type":"text"},{"text":"modules/…","type":"text","marks":[{"type":"code_inline"}]},{"text":").","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Access to the component's JS/TS, HTML templates, CSS, and ","type":"text"},{"text":".js-meta.xml","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Output mode: ","type":"text"},{"text":"review","type":"text","marks":[{"type":"code_inline"}]},{"text":" (default — find, fix, report) or ","type":"text"},{"text":"score","type":"text","marks":[{"type":"code_inline"}]},{"text":" (find, emit SARIF JSON, do NOT modify code). Confirm with the user before starting if it isn't obvious from the request.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Knowledge Bases","type":"text"}]},{"type":"paragraph","content":[{"text":"Each reference is the source of truth. Do not summarize from memory — open the reference, apply the guidelines, and cite the specific section you used in the report.","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Lightning Web Security (LWS) catalog: ","type":"text"},{"text":"LWS Security Expert","type":"text","marks":[{"type":"link","attrs":{"href":"references/lws-security-expert.md","title":null}}]},{"text":" — blocked APIs and allowed alternatives.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Rule catalog (","type":"text"},{"text":"lws-001","type":"text","marks":[{"type":"code_inline"}]},{"text":"…","type":"text"},{"text":"lws-023b","type":"text","marks":[{"type":"code_inline"}]},{"text":"): ","type":"text"},{"text":"Product Security Framework","type":"text","marks":[{"type":"link","attrs":{"href":"references/security-analysis.md","title":null}}]},{"text":" — for every rule the catalog gives the detection patterns and the canonical SARIF ","type":"text"},{"text":"ruleId","type":"text","marks":[{"type":"code_inline"}]},{"text":" / ","type":"text"},{"text":"level","type":"text","marks":[{"type":"code_inline"}]},{"text":" / ","type":"text"},{"text":"message","type":"text","marks":[{"type":"code_inline"}]},{"text":" template. ","type":"text"},{"text":"Score mode emits one SARIF result per match using these exact values.","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Workflow","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 1 — Scope the review","type":"text"}]},{"type":"paragraph","content":[{"text":"Collect the component path and identify the files to review. Include every file in the component bundle: ","type":"text"},{"text":".html","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":".js","type":"text","marks":[{"type":"code_inline"}]},{"text":"/","type":"text"},{"text":".ts","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":".css","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":".js-meta.xml","type":"text","marks":[{"type":"code_inline"}]},{"text":", and any child components owned by the same team that are invoked from the target.","type":"text"}]},{"type":"paragraph","content":[{"text":"Note any existing feature-flag gates — findings that require code changes must respect them.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 2 — Read the knowledge bases","type":"text"}]},{"type":"paragraph","content":[{"text":"Read ","type":"text"},{"text":"LWS Security Expert","type":"text","marks":[{"type":"link","attrs":{"href":"references/lws-security-expert.md","title":null}}]},{"text":" and ","type":"text"},{"text":"Product Security Framework","type":"text","marks":[{"type":"link","attrs":{"href":"references/security-analysis.md","title":null}}]},{"text":" top-to-bottom before judging. The LWS reference enumerates blocked DOM APIs and their allowed alternatives; the Product Security framework gives the severity taxonomy, the 23-rule SARIF catalog, and remediation patterns.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 3 — Walk the rule catalog","type":"text"}]},{"type":"paragraph","content":[{"text":"Run every rule in ","type":"text"},{"text":"Product Security Framework","type":"text","marks":[{"type":"link","attrs":{"href":"references/security-analysis.md","title":null}}]},{"text":" (","type":"text"},{"text":"lws-001","type":"text","marks":[{"type":"code_inline"}]},{"text":" through ","type":"text"},{"text":"lws-023b","type":"text","marks":[{"type":"code_inline"}]},{"text":") against the component bundle. For each rule:","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Apply the ","type":"text"},{"text":"\"How to Find the Issue\"","type":"text","marks":[{"type":"strong"}]},{"text":" patterns verbatim. Do NOT shortcut — each rule lists obfuscation patterns (bracket notation, unicode escapes, ","type":"text"},{"text":"Reflect.*","type":"text","marks":[{"type":"code_inline"}]},{"text":", string concatenation) you must consider.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"For every match record: ","type":"text"},{"text":"ruleId","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"level","type":"text","marks":[{"type":"code_inline"}]},{"text":" (","type":"text"},{"text":"error","type":"text","marks":[{"type":"code_inline"}]},{"text":" / ","type":"text"},{"text":"warning","type":"text","marks":[{"type":"code_inline"}]},{"text":" from the catalog), ","type":"text"},{"text":"file","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"startLine","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"startColumn","type":"text","marks":[{"type":"code_inline"}]},{"text":" (column 1 if unknown), ","type":"text"},{"text":"message","type":"text","marks":[{"type":"code_inline"}]},{"text":" (use the catalog's ","type":"text"},{"text":"message","type":"text","marks":[{"type":"code_inline"}]},{"text":" template, substituting any ","type":"text"},{"text":"{placeholder}","type":"text","marks":[{"type":"code_inline"}]},{"text":" from the actual code).","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"If a rule has the prerequisite \"Only analyze files that import from 'lwc'\" (lws-008), gate it via ","type":"text"},{"text":"scripts/check-lwc-import.sh \u003cfile>","type":"text","marks":[{"type":"code_inline"}]},{"text":" — the script prints ","type":"text"},{"text":"lwc-import=yes","type":"text","marks":[{"type":"code_inline"}]},{"text":" when a ","type":"text"},{"text":"from 'lwc'","type":"text","marks":[{"type":"code_inline"}]},{"text":" import is present and ","type":"text"},{"text":"lwc-import=no","type":"text","marks":[{"type":"code_inline"}]},{"text":" otherwise. Skip the rule for that file when the answer is ","type":"text"},{"text":"no","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"This catalog is the canonical detection list; the JS/TS, HTML, and ","type":"text"},{"text":".js-meta.xml","type":"text","marks":[{"type":"code_inline"}]},{"text":" bullets that follow are ","type":"text"},{"text":"additional","type":"text","marks":[{"type":"em"}]},{"text":" checks beyond the SARIF rules.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 4 — HTML template inspection (additional)","type":"text"}]},{"type":"paragraph","content":[{"text":"Walk each template for:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"lwc:inner-html","type":"text","marks":[{"type":"code_inline"}]},{"text":" usage — verify the source is trusted.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Unescaped expressions feeding attributes LWS treats as sensitive (","type":"text"},{"text":"href","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"src","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"srcdoc","type":"text","marks":[{"type":"code_inline"}]},{"text":", inline event handlers).","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Direct ","type":"text"},{"text":"style=\"…\"","type":"text","marks":[{"type":"code_inline"}]},{"text":" with bound expressions — candidates for CSS class swaps.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Embedded ","type":"text"},{"text":"\u003ciframe>","type":"text","marks":[{"type":"code_inline"}]},{"text":" or ","type":"text"},{"text":"\u003cobject>","type":"text","marks":[{"type":"code_inline"}]},{"text":" without sandboxing (Step 3 catches the ","type":"text"},{"text":"srcdoc","type":"text","marks":[{"type":"code_inline"}]},{"text":" and protocol cases via lws-023a/lws-023b; this step catches missing ","type":"text"},{"text":"sandbox","type":"text","marks":[{"type":"code_inline"}]},{"text":" attributes).","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 5 — Meta and configuration inspection (additional)","type":"text"}]},{"type":"paragraph","content":[{"text":"Inspect ","type":"text"},{"text":".js-meta.xml","type":"text","marks":[{"type":"code_inline"}]},{"text":" for:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Over-broad API access (","type":"text"},{"text":"lightning__FlowScreen","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"lightning__AppPage","type":"text","marks":[{"type":"code_inline"}]},{"text":", etc.) when the component doesn't need it.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Public properties exposed that contain sensitive data.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Missing ","type":"text"},{"text":"capabilities","type":"text","marks":[{"type":"code_inline"}]},{"text":" restrictions for the target surface.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Inspect Apex bindings for:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"@wire","type":"text","marks":[{"type":"code_inline"}]},{"text":" to Apex methods without ","type":"text"},{"text":"@AuraEnabled(cacheable=true)","type":"text","marks":[{"type":"code_inline"}]},{"text":" where caching is safe.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Direct imperative calls that bypass permission checks.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Findings from Steps 4-5 use rule IDs ","type":"text"},{"text":"lws-tpl-001","type":"text","marks":[{"type":"code_inline"}]},{"text":"…","type":"text"},{"text":"lws-tpl-NNN","type":"text","marks":[{"type":"code_inline"}]},{"text":" (HTML) and ","type":"text"},{"text":"lws-meta-001","type":"text","marks":[{"type":"code_inline"}]},{"text":"…","type":"text"},{"text":"lws-meta-NNN","type":"text","marks":[{"type":"code_inline"}]},{"text":" (meta) — sequence numbers per finding within the report — so they don't collide with the SARIF catalog.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 6 — Produce the report","type":"text"}]},{"type":"paragraph","content":[{"text":"Pick the output format based on the mode confirmed in Prerequisites.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Review mode (default)","type":"text"}]},{"type":"paragraph","content":[{"text":"Use ","type":"text"},{"text":"examples/review-report.md","type":"text","marks":[{"type":"link","attrs":{"href":"examples/review-report.md","title":null}}]},{"text":" as the template — one bullet per finding under ","type":"text"},{"text":"## Security (LWS + Product)","type":"text","marks":[{"type":"code_inline"}]},{"text":", one totals line under ","type":"text"},{"text":"## Summary","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Severity ordering: Critical → High → Medium → Low (map SARIF ","type":"text"},{"text":"error","type":"text","marks":[{"type":"code_inline"}]},{"text":" → High, ","type":"text"},{"text":"warning","type":"text","marks":[{"type":"code_inline"}]},{"text":" → Medium unless the rule says otherwise). Cite the reference section that produced each finding (e.g., \"Product Security § lws-001 document.createProcessingInstruction\").","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Score mode","type":"text"}]},{"type":"paragraph","content":[{"text":"Emit a single SARIF 2.1.0 JSON document — and nothing else. No prose before or after. Do NOT write the JSON to a file; return it inline. Empty ","type":"text"},{"text":"results","type":"text","marks":[{"type":"code_inline"}]},{"text":" array means no issues found.","type":"text"}]},{"type":"paragraph","content":[{"text":"Use ","type":"text"},{"text":"examples/score-report.sarif.json","type":"text","marks":[{"type":"link","attrs":{"href":"examples/score-report.sarif.json","title":null}}]},{"text":" as the shape reference — same top-level structure (","type":"text"},{"text":"$schema","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"version","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"runs[0].tool.driver.rules[]","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"runs[0].results[]","type":"text","marks":[{"type":"code_inline"}]},{"text":"), populated with the actual rules that fired and the actual matches.","type":"text"}]},{"type":"paragraph","content":[{"text":"Rules:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"ruleId","type":"text","marks":[{"type":"code_inline"}]},{"text":" matches a catalog entry exactly (","type":"text"},{"text":"lws-001","type":"text","marks":[{"type":"code_inline"}]},{"text":"…","type":"text"},{"text":"lws-023b","type":"text","marks":[{"type":"code_inline"}]},{"text":", or the ","type":"text"},{"text":"lws-tpl-*","type":"text","marks":[{"type":"code_inline"}]},{"text":" / ","type":"text"},{"text":"lws-meta-*","type":"text","marks":[{"type":"code_inline"}]},{"text":" namespaces from Steps 4-5).","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"level","type":"text","marks":[{"type":"code_inline"}]},{"text":" is ","type":"text"},{"text":"error","type":"text","marks":[{"type":"code_inline"}]},{"text":" for catalog rules marked ","type":"text"},{"text":"level: error","type":"text","marks":[{"type":"code_inline"}]},{"text":" and ","type":"text"},{"text":"warning","type":"text","marks":[{"type":"code_inline"}]},{"text":" for ","type":"text"},{"text":"level: warning","type":"text","marks":[{"type":"code_inline"}]},{"text":". No other values.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"message.text","type":"text","marks":[{"type":"code_inline"}]},{"text":" uses the catalog's ","type":"text"},{"text":"message","type":"text","marks":[{"type":"code_inline"}]},{"text":" template with placeholders substituted (e.g., replace ","type":"text"},{"text":"{eventName}","type":"text","marks":[{"type":"code_inline"}]},{"text":" with the actual event name found in code).","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"One ","type":"text"},{"text":"result","type":"text","marks":[{"type":"code_inline"}]},{"text":" per match. If a rule fires three times in a file, emit three results.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Include only rules that fired in ","type":"text"},{"text":"tool.driver.rules","type":"text","marks":[{"type":"code_inline"}]},{"text":"; an empty ","type":"text"},{"text":"results","type":"text","marks":[{"type":"code_inline"}]},{"text":" array still requires ","type":"text"},{"text":"tool.driver.rules","type":"text","marks":[{"type":"code_inline"}]},{"text":" to be present (use ","type":"text"},{"text":"[]","type":"text","marks":[{"type":"code_inline"}]},{"text":").","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 7 — Apply fixes (review mode only)","type":"text"}]},{"type":"paragraph","content":[{"text":"Skip in score mode — score mode is read-only.","type":"text"}]},{"type":"paragraph","content":[{"text":"For each accepted finding:","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Edit the component files (HTML, JS/TS, CSS, meta.xml) to apply the fix.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Preserve existing correct behavior and existing feature-flag gates. If a gate is already configured for the same concern, leave it untouched. New feature-flag gates for phased rollout are out of scope for this skill — apply them separately.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Do NOT silently delete old code — preserve the original path where a gate is required.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Do NOT weaken the security posture to make tests pass; fix the test if it depends on the insecure pattern.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 8 — Verify","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Review mode","type":"text","marks":[{"type":"strong"}]},{"text":": Re-run Step 3's catalog walk against the updated files; every fixed finding must no longer appear. Run Jest tests and any component-level security tests. If fixes touched Apex access patterns, confirm permissions with the server-side reviewer.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Score mode","type":"text","marks":[{"type":"strong"}]},{"text":": Before returning, write the emitted SARIF to a temporary file and run ","type":"text"},{"text":"scripts/validate-sarif.sh \u003cpath>","type":"text","marks":[{"type":"code_inline"}]},{"text":" — the script confirms the JSON parses, ","type":"text"},{"text":"version","type":"text","marks":[{"type":"code_inline"}]},{"text":" is ","type":"text"},{"text":"2.1.0","type":"text","marks":[{"type":"code_inline"}]},{"text":", every ","type":"text"},{"text":"ruleId","type":"text","marks":[{"type":"code_inline"}]},{"text":" matches the catalog pattern (","type":"text"},{"text":"lws-NNN[a-z]?","type":"text","marks":[{"type":"code_inline"}]},{"text":" / ","type":"text"},{"text":"lws-tpl-NNN","type":"text","marks":[{"type":"code_inline"}]},{"text":" / ","type":"text"},{"text":"lws-meta-NNN","type":"text","marks":[{"type":"code_inline"}]},{"text":") and is declared in ","type":"text"},{"text":"tool.driver.rules","type":"text","marks":[{"type":"code_inline"}]},{"text":", every ","type":"text"},{"text":"level","type":"text","marks":[{"type":"code_inline"}]},{"text":" is ","type":"text"},{"text":"error","type":"text","marks":[{"type":"code_inline"}]},{"text":" or ","type":"text"},{"text":"warning","type":"text","marks":[{"type":"code_inline"}]},{"text":", and every result has a ","type":"text"},{"text":"physicalLocation.artifactLocation.uri","type":"text","marks":[{"type":"code_inline"}]},{"text":" + ","type":"text"},{"text":"region.startLine","type":"text","marks":[{"type":"code_inline"}]},{"text":". Fix any failure before returning the SARIF.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Cross-References","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Related skills:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"experience-lwc-generate","type":"text","marks":[{"type":"code_inline"}]},{"text":" — for authoring new LWC bundles that are security-compliant from the start.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"design-systems-slds-validate","type":"text","marks":[{"type":"code_inline"}]},{"text":" — SLDS/design-system compliance pass (accessibility overlaps with WCAG 2.2 — run separately).","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"dx-code-analyzer-run","type":"text","marks":[{"type":"code_inline"}]},{"text":" — repo-wide static-analysis pass; use it alongside this skill for coverage beyond the LWS catalog.","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Verification","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Every catalog rule (","type":"text"},{"text":"lws-001","type":"text","marks":[{"type":"code_inline"}]},{"text":"…","type":"text"},{"text":"lws-023b","type":"text","marks":[{"type":"code_inline"}]},{"text":") was evaluated against the bundle, not a hand-curated subset.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Every finding has either been applied (review mode) or surfaced in the SARIF result (score mode), or carries an explicit deferred note with a reason.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Each finding cites a specific catalog rule ID — no freeform \"looks suspicious\" entries.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"No new XSS sinks, unsafe URL flows, or blocked DOM APIs introduced by the fixes.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Score-mode output is valid SARIF 2.1.0 JSON, returned inline, with no surrounding prose.","type":"text"}]}]}]}]},"metadata":{"date":"2026-11-02","name":"experience-lwc-security-validate","author":"@skillopedia","source":{"stars":1139,"repo_name":"sf-skills","origin_url":"https://github.com/forcedotcom/sf-skills/blob/HEAD/skills/experience-lwc-security-validate/SKILL.md","repo_owner":"forcedotcom","body_sha256":"9acb419f1a06f91230072138bb5f505d5e0a6249960d5e6e023d2fd23bcd145d","cluster_key":"164fd6939ed54081161a678be591f34bf5c03eea225e030d6179430b58385351","clean_bundle":{"format":"clean-skill-bundle-v1","source":"forcedotcom/sf-skills/skills/experience-lwc-security-validate/SKILL.md","text_bytes":88578,"source_commit":"a8a18ce1e4ba12e69b4073eab98ce31bfbd8271e","skills_sh_rank":7763,"attachment_count":6,"text_attachments":6,"attachment_storage":"skill_attachments","binary_attachments":0},"cluster_size":1,"skill_md_path":"skills/experience-lwc-security-validate/SKILL.md","import_metadata":{"date":"2026-11-02","author":"@skillopedia","version":"v1","category":"security","category_label":"Security"},"exact_dupes_collapsed_into_this":0},"version":"v1","category":"security","metadata":{"domains":["Experience"],"version":"1.0","cliTools":[{"tool":["jq"],"semver":">=1.6"},{"tool":["python3"],"semver":">=3.8"}],"relatedSkills":["design-systems-slds-validate","dx-code-analyzer-run","experience-lwc-generate"]},"import_tag":"skills-sh-top20k-2026-11","description":"Use this skill as THE specialized Lightning Web Security (LWS) validator for a Lightning Web Component bundle (`.js`, `.ts`, `.html`, `.css`, `.js-meta.xml`) — the canonical LWS/Product-Security review for LWCs, NOT a generic code-security pass. It produces either a severity-ranked finding list with code-level remediations or a SARIF 2.1.0 JSON score report keyed by the `lws-001`…`lws-023b` rule catalog. TRIGGER when the user asks to review, audit, or check an LWC component for LWS compliance issues and recommend fixes, score a component's LWS/security compliance, find dangerous DOM APIs or blocked sinks (`eval`, `Function`, `document.write`, `innerHTML`, `document.createElement('script')`, global-scope assignment to `window`/`globalThis`, unsafe URL schemes), or emit a SARIF security report. DO NOT TRIGGER for generic non-LWC security review, for building a new LWC (use experience-lwc-generate), accessibility (WCAG 2.2), RTL/i18n, or Apex/Aura/server-side review."}},"renderedAt":1793666381866}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.