The Agent Skills Directory

Indirect Prompt Injection (LOW): Detected a vulnerability surface for indirect injection and reflected XSS in the client-side component.\n
Ingestion points: ApiClient.js processes JSON response data from the server in request(), handleError(), and handleValidationError().\n
Boundary markers: Absent; data received from the API is treated as trusted content.\n
Capability inventory: Use of SweetAlert2's html property in ApiClient.js (lines 115, 137, 150) allows for the execution of arbitrary HTML and JavaScript within the user context.\n
Sanitization: Absent; the code does not sanitize or escape server-reflected values (which often contain user-controlled input like duplicate record values) before rendering them in the UI.\n- Data Exposure & Exfiltration (MEDIUM): Information disclosure of sensitive internal server paths.\n
Evidence: In ExceptionHandler.php (line 282), the handleGenericException method includes the full server-side file path and line number of the error in the API response when the APP_DEBUG constant is true.\n
Impact: This reveals the internal directory structure of the host (e.g., /var/www/html/references/...), providing reconnaissance data that can be leveraged for further attacks or path traversal attempts.

api-error-handling