The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The AI-related recipes (08-ai-assistant.ts and 09-web-search-llm.ts) ingest data from external sources (CRM records and web search results) and interpolate them into prompts for an LLM.
Ingestion points: CRM deal data and activity history are loaded in 08-ai-assistant.ts; external web search content is ingested in 09-web-search-llm.ts.
Boundary markers: The skill uses labeled blocks (e.g., 'Deal:', 'Activities:', 'Sources:') to separate untrusted data from the system instructions.
Capability inventory: The LLM output is used to perform API calls via the Bitrix24 SDK, specifically tasks.task.add to create tasks and crm.timeline.comment.add to post comments.
Sanitization: The recipes include defensive JSON.parse blocks for AI responses and specific HTML escaping (escape function in 06-telegram-bot.ts) to prevent XSS when sending CRM data to external messaging platforms.
[CREDENTIALS_SAFE]: The skill consistently follows best practices for secret management. It instructs users to load sensitive values like B24_HOOK, OPENAI_API_KEY, and B24_CLIENT_SECRET from environment variables rather than hardcoding them.
[COMMAND_EXECUTION]: The OAuth handshake recipe (12-oauth-install.ts) implements robust validation of portal URLs via checkPortalUrls in lib/portal-url.ts. This logic prevents SSRF and credential redirection by ensuring that endpoints match the expected Bitrix24 domains before the application performs REST calls or token refreshes.
[SAFE]: The skill includes a dedicated crypto helper (lib/crypto.ts) that implements safeEqual using node:crypto.timingSafeEqual. This is used to verify webhook tokens and application secrets, effectively mitigating timing-based side-channel attacks.

b24jssdk-recipes