forcedotcom/sf-skills experience-lwc-runtime-observe
Checked the catalogued skill at experience-lwc-runtime-observe.
F; retained sample includes a critical finding · SD-001 · what this rule accepts as a false positive →
A set by no findings on this axis
A set by no findings on this axis
5 suppressed by AI triage
The snippet is part of a documentation example showing how to run scripts, not an actual malicious payload.
The eval is used on script-generated environment variables, not directly on untrusted input, making it safe in this context.
Similar to finding 1, the eval operates on script output rather than raw user input, rendering it a benign usage.
Only a URL string is referenced in a message; no outbound network call is executed.
The backticks appear only within a string literal passed to fail, not as command substitution, so no shell injection occurs.