The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill describes processes for ingesting and rendering external data within document templates, which introduces a surface for indirect prompt injection. \n- Ingestion points: Content is sourced from data providers (rules/providers.md) and DOCX templates (rules/templates.md) that may originate from untrusted users. \n- Boundary markers: Developers are instructed to manually implement hasAccess() checks in providers to define data boundaries, though these are not enforced by the core Template or Document classes during initialization. \n- Capability inventory: The module is capable of generating persistent files (DOCX, PDF) and fetching remote image assets via URL. \n- Sanitization: While the documentation mentions DOCX normalization to fix Word-specific formatting issues, it does not specify sanitization or escaping of the actual content inserted into placeholders. \n- [DATA_EXFILTRATION]: The image generation feature includes a Server-Side Request Forgery (SSRF) attack surface. \n- Evidence: According to rules/templates.md, image placeholder values can be http(s) URLs. If the data provider supplies a URL controlled by an attacker, the server will attempt to fetch the resource, potentially exposing internal services or metadata endpoints. \n- [PRIVILEGE_ESCALATION]: The skill documents an architectural feature that allows for complete authorization bypass during code execution. \n- Evidence: In rules/access-rest.md and rules/generation.md, it is explicitly stated that using User ID 0 (system/CLI context) causes hasAccess() and other permission checks to pass automatically. Misuse of this ID in automated tasks or agents could lead to unauthorized document creation and data exposure.

bitrix-documentgenerator