From vanguard-frontier-agentic
Reviews Salesforce Apex classes, triggers, LWC, and async jobs for security vulnerabilities, governor-limit risks, and sharing enforcement issues. Works from pasted code only.
How this skill is triggered — by the user, by Claude, or both
Slash command
/vanguard-frontier-agentic:salesforce-apex-lwc-code-review-skillThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
This skill reviews Salesforce Apex classes, triggers, Lightning Web Components
This skill reviews Salesforce Apex classes, triggers, Lightning Web Components ( LWC), and async jobs for security vulnerabilities, governor-limit risk, test coverage patterns, and sharing enforcement. It flags patterns that cause data exposure, runaway resource consumption, or privilege escalation. It does not execute code, access live orgs, or authorize deployments.
salesforce-flow-automation-review-skill.salesforce-metadata-review-skill.salesforce-live-change-approval-protocol.salesforce-org-assessment-skill.[SELECT ... FROM ...]) inside for loops,
while loops, or recursive method calls.insert, update, delete, upsert, merge,
undelete) inside loops.sharing keyword:
with sharing — enforces the running user's sharing rules (recommended default).without sharing — bypasses sharing; flag all usages and require documented justification.inherited sharing — flag if used in entry-point classes where explicit control is expected.without sharing in most contexts; flag all missing keywords.without sharing
or omits the keyword.WITH SECURITY_ENFORCED or WITH USER_MODE clause.Security.stripInaccessible usage before accessing returned field values.SeeAllData=true (
deprecated pattern).System.assertEquals, System.assertNotEquals,
System.assert).<lightning-formatted-rich-text> or
innerHTML bindings with unsanitized values (XSS risk).eval, Function constructor, or dangerouslySetInnerHTML
equivalents.Database.Batchable implementations that query without
scope limitation; flag missing finish method implementations.@future(callout=true) methods called from loops.apex_lwc_code_review_findings:
soql_in_loops:
- location: [class/method or line range]
severity: High
recommendation: [brief]
dml_in_loops:
- location: [...]
severity: High
recommendation: [...]
sharing_enforcement:
- class: [name]
keyword: with sharing | without sharing | inherited sharing | missing
severity: Critical | High | Medium | Low
justification_required: true | false
recommendation: [...]
fls_enforcement:
- query_location: [...]
with_security_enforced: present | absent
strip_inaccessible: present | partial | absent
severity: [...]
recommendation: [...]
governor_limit_risks:
- pattern: [description]
severity: [...]
recommendation: [...]
test_coverage_patterns:
- finding: [description]
severity: [...]
recommendation: [...]
lwc_security_findings:
- finding: [description]
severity: [...]
recommendation: [...]
async_job_findings:
- finding: [description]
severity: [...]
recommendation: [...]
summary:
total_findings: [count]
critical_count: [count]
high_count: [count]
escalation_gates_fired: [from salesforce-risk-taxonomy, or "none"]
assumptions: [list]
missing_evidence: [what would improve the review]
without sharing classes handling PII must be flagged for compliance review.without sharing on PII-handling class in production — flag immediately and require human review.without sharing is a security-relevant decision; every usage must have documented justification.npx claudepluginhub raishin/vanguard-frontier-agentic --plugin vanguard-frontier-agenticGenerates production-grade Apex classes with Service-Selector-Domain layering, sharing models, and async patterns (Queueable, Batchable, Schedulable). Static code generation without org connection.
Generates, refactors, and reviews Apex classes including service, selector, domain, triggers, batch, queueable, and REST resources. Includes test generation.
Identifies Salesforce pitfalls like SOQL N+1 queries, governor limit violations, API overuse, and SOQL injection during code reviews, onboarding, and integration audits.