The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The generated Python agent scaffold is vulnerable to indirect prompt injection because it directly interpolates untrusted event data into the user prompt.
Ingestion points: The run_agent(event) function in the Python Core Agent Scaffold (SKILL.md) accepts an event dictionary as input.
Boundary markers: There are no specific boundary markers (e.g., XML tags or delimiters) or instructions to ignore embedded commands within the event data; it is simply passed via json.dumps(event, indent=2).
Capability inventory: The generated agent has access to the take_action tool, which can execute create, update, assign, notify, and escalate actions in target enterprise systems like Salesforce or ServiceNow.
Sanitization: The skill does not provide mechanisms for sanitizing or filtering the event payload before it is processed by the LLM.
[DYNAMIC_EXECUTION]: The skill generates code templates that use unsafe patterns for database interactions, which could lead to injection vulnerabilities in the deployed agents.
SQL/SOQL Construction: The generated Salesforce (Apex) template uses string concatenation to build a SOQL query ('SELECT Id, Name FROM ' + objectType + ...), which is unsafe if the object type is derived from untrusted input.
Snowflake SQL Construction: The generated Snowflake (Python) template uses f-strings to construct SQL queries (f"UPDATE {table} SET ai_recommendation = '{result}' WHERE id = '{row['ID']}'"). Since {result} is the output from an LLM (Complete("claude-opus-4-6", prompt)), an attacker could potentially influence the LLM output to perform SQL injection.

enterprise-agent-builder