The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a framework for processing data from untrusted external sources (such as Slack, Google Drive, and in-app chat messages), which represents an inherent surface for indirect prompt injection.
Ingestion points: Data enters the workflow context through connector, entity, and in_app_agent triggers, specifically within the .trigger.data and .trigger.data.message.text fields described in references/backend-functions.md and references/web-tanstack.md.
Boundary markers: The platform utilizes structured JSON for workflow definitions and jq for data extraction, which provides structural separation between the automation logic and the external data payloads.
Capability inventory: Workflows are capable of invoking code through invoke_backend_function and invoke_server_route, and can initiate platform security scans using the app_security_scan activity.
Sanitization: The instructions include explicit security guidance, advising developers to implement authentication middleware (e.g., requireUserRoute) and administrative role checks (e.g., user.role === 'admin') within the backend handlers that process the ingested data.

base44-platform-workflows