sf-message-catalog — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sf-message-catalog (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate a complete, customer-facing catalog of every user-facing message in a Salesforce managed package. The output is a professional landscape .docx with color-coded severity, organized by component type.
docx SKILL.md in your available skills. You will generate a .docx using docx-js.mcp__salesforce-*__tooling_execute or mcp__Salesforce-*__tooling_execute. If multiple orgs are connected, ask the user to pick one. If only one is available, confirm it.kugo2p). This is used to filter Tooling API queries to only components belonging to that package.Query the Salesforce Tooling API for source code across five component types. For each, extract every user-facing message string along with its method/context, triggering condition, and severity.
Query all Apex classes and triggers in the namespace:
SELECT Id, Name, Body FROM ApexClass WHERE NamespacePrefix = '{namespace}'
SELECT Id, Name, Body FROM ApexTrigger WHERE NamespacePrefix = '{namespace}'Search each body for these patterns (in priority order):
| Pattern | Severity |
|---|---|
.addError('...') | ERROR |
ApexPages.addMessage(...) with ApexPages.Severity.ERROR | ERROR |
ApexPages.addMessage(...) with ApexPages.Severity.WARNING | WARNING |
ApexPages.addMessage(...) with ApexPages.Severity.INFO | INFO |
ApexPages.addMessage(...) with ApexPages.Severity.CONFIRM | CONFIRM |
throw new ...Exception('...') | ERROR |
String variables assigned then passed to addError or addMessage | Varies |
For each message found, record:
{merge fields})if / guard clause that triggers it (summarize in plain English)Query LWC bundles and their resources:
SELECT Id, DeveloperName FROM LightningComponentBundle WHERE NamespacePrefix = '{namespace}'Then for each bundle, fetch JS resources:
SELECT Id, Source, FilePath FROM LightningComponentResource
WHERE LightningComponentBundleId = '{bundleId}'
AND FilePath LIKE '%.js'Search each JS source for these patterns:
| Pattern | Severity |
|---|---|
ShowToastEvent({ ... variant: 'error' }) | ERROR |
ShowToastEvent({ ... variant: 'warning' }) | WARNING |
ShowToastEvent({ ... variant: 'info' }) | INFO |
ShowToastEvent({ ... variant: 'success' }) | CONFIRM |
Custom c-toast-lwc or c-error-panel component usage | Varies |
setCustomValidity('...') | ERROR |
.catch(error => ...) with error display | ERROR |
String literals in this.errorMessage = '...' assignments | ERROR |
Query Aura bundles and their definitions:
SELECT Id, DeveloperName FROM AuraDefinitionBundle WHERE NamespacePrefix = '{namespace}'Then for each bundle, fetch controller, helper, and component markup:
SELECT Id, Source, DefType FROM AuraDefinition
WHERE AuraDefinitionBundleId = '{bundleId}'
AND DefType IN ('CONTROLLER', 'HELPER', 'COMPONENT')Search for these patterns:
| Pattern | Severity |
|---|---|
$A.get("e.force:showToast") with type: 'error' | ERROR |
$A.get("e.force:showToast") with type: 'warning' | WARNING |
$A.get("e.force:showToast") with type: 'info' | INFO |
$A.get("e.force:showToast") with type: 'success' | CONFIRM |
component.set("v.errorMessage", '...') | ERROR |
ServerActionService centralized error handlers | ERROR |
Custom c:Alert or c:Toast event firing | Varies |
aura:if with isTrue="{!v.showError}" in markup | Varies |
SELECT Id, Name, Markup FROM ApexPage WHERE NamespacePrefix = '{namespace}'Search each markup for:
| Pattern | Severity |
|---|---|
<apex:pageMessages/> (renders controller messages) | Varies |
<apex:pageMessage ... severity="error"> | ERROR |
<apex:pageMessage ... severity="warning"> | WARNING |
<apex:pageMessage ... severity="info"> | INFO |
<apex:pageMessage ... severity="confirm"> | CONFIRM |
JavaScript alert('...') | ERROR |
JavaScript confirm('...') | WARNING |
Conditionally rendered <div> or <apex:outputPanel> with error text | Varies |
SLDS toast markup (slds-notify--toast) | Varies |
c:Alert VF component references | Varies |
SELECT Id, Name, Markup FROM ApexComponent WHERE NamespacePrefix = '{namespace}'Search for the same patterns as VF Pages, plus:
Error: Invalid Quantity)<apex:outputText> with conditional rendering showing error/status messagesThe extraction across five component types is independent work. Use subagents to process all five types in parallel when possible:
Each agent should return its findings as structured arrays in this format:
[sequenceNumber, methodOrContext, messageText, triggerCondition, severity]Create a landscape .docx using docx-js (npm install docx if needed). The document structure:
{Package Name} — Error & Warning Message CatalogGenerated {date}#C00000) — Blocks the operation#BF8F00) — Alerts but may allow proceeding#2E75B6) — Informational, does not block#548235) — Success confirmationEach section gets:
H1 heading with section number and group nameH2) per class/component with a 5-column table:| # | Method/Context | Message | Condition | Severity |
|---|
Color-code the Severity cell text using the severity colors above.
#F2F7FB / #FFFFFF)#1F4E79 with white text)After generating, validate the docx:
python <path-to-docx-skill>/scripts/office/validate.py output.docxSave the file with a descriptive name like {PackageName} Message Catalog.docx and provide the user a link.
This skill is designed to be run monthly to keep the catalog current as the managed package evolves. When scheduling:
0 9 1 * * (1st of each month at 9 AM)Id IN (...) filters).tooling_execute endpoint with a REST query and paginate.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.