The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it fetches and processes external GraphQL schema data from a Salesforce organization. A malicious actor with control over the Salesforce org's schema could include instructions in field names or descriptions designed to manipulate the agent's output during query generation.
Ingestion points: The schema.graphql file is fetched from an external org via the scripts/fetch-lds-graphql-schema.sh script.
Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded content within the schema file; the agent uses standard grep commands to extract information.
Capability inventory: The skill has capabilities to perform network requests via the sf CLI, read/write files in the local workspace, and generate executable code (GraphQL/LWC).
Sanitization: While the schema is converted from JSON to SDL format using a Python script, there is no validation or sanitization of the content (like field descriptions) before it is processed by the agent.
[COMMAND_EXECUTION]: The skill executes local bash scripts (scripts/fetch-lds-graphql-schema.sh and scripts/test-lds-graphql-query.sh) which utilize the Salesforce CLI ('sf') to perform network operations and authenticate with Salesforce orgs.
Evidence: Instructions in SKILL.md direct the agent to run these scripts using user-supplied aliases and agent-generated queries. The scripts include security-conscious design elements, such as using Python's os.path.realpath to prevent path traversal and a regex-based mutation guard to prevent accidental write operations during testing.

experience-lds-graphql-generate