The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides patterns for executing external system commands using the Symfony Process component (e.g., invoking ffmpeg for audio processing). The implementation uses array-based arguments, which is a security best practice to prevent shell injection, though it still exposes a capability for subprocess execution.
[INDIRECT_PROMPT_INJECTION]: The skill documents extensive data ingestion surfaces via the Request, Form, and Serializer components, which can be vectors for indirect prompt injection.
Ingestion points: Data is ingested through HTTP requests, form submissions, and serialized payloads in various formats (JSON, EML).
Boundary markers: The documented patterns do not explicitly include instructions to delimit or ignore potential malicious prompts embedded in the ingested data before it is processed.
Capability inventory: The skill documents capabilities for subprocess execution (Process::run) and file system operations (file_put_contents).
Sanitization: The skill promotes the use of the Symfony Validator component for data integrity and business logic validation.
[DYNAMIC_EXECUTION]: The skill demonstrates the use of PHP Reflection (ReflectionClass) to dynamically inspect and modify object properties at runtime, specifically within the EncryptionSubscriber example to handle encrypted fields.
[EXTERNAL_DOWNLOADS]: The skill includes instructions for fetching external JavaScript dependencies using the importmap:require command (e.g., lodash). These downloads target well-known package registries and services.

symfony