The Agent Skills Directory

[DYNAMIC_EXECUTION]: Custom blocks stored in /local/blocks/ can include a class.php file that is dynamically loaded and executed by the Bitrix platform when the block is rendered, providing a runtime execution path for PHP code.
[INDIRECT_PROMPT_INJECTION]: The skill documents methods for ingesting data from untrusted sources, such as REST API payloads in landing.repo.register and user-controlled content in Block::saveContent.
Ingestion points: rules/rest-security.md (REST API input) and rules/pages-blocks.md (block content).
Boundary markers: The skill does not provide specific delimiters for the agent to use to isolate untrusted data.
Capability inventory: Includes PHP file execution in custom blocks, file writing via Manager::savePicture, and management of site hooks.
Sanitization: The documentation references Bitrixinishitrix-landing ules est-security.md and Security\RepoNormalizer as tools for data validation.
[DATA_EXFILTRATION]: The Bitrix\Landing\Manager::savePicture method allows for processing local file paths. If the trustedSource parameter is incorrectly set to true when handling user-provided data, it could lead to unauthorized access to files on the server.

bitrix-landing