The Agent Skills Directory

[PROMPT_INJECTION]: The skill facilitates the creation of web controllers that ingest untrusted data from external sources (GET, POST, and FILES requests), creating a potential surface for indirect prompt injection if the processed data is subsequently handled by an LLM.
Ingestion points: Controller actions defined in rules/basics.md and rules/filters.md receive input via action parameters and Request Data Transfer Objects (DTOs).
Boundary markers: The skill suggests using ValidationParameter for mapping and validation of non-trivial input structures to enforce data constraints.
Capability inventory: Controllers can invoke business services (PostService), load ORM objects based on user-provided IDs, and return various response types including JSON and files.
Sanitization: Input sanitization relies on PHP scalar type hinting and framework-level validation mechanisms mentioned in the getAutoWiredParameters configuration.

bitrix-controllers