The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents APIs for handling user-provided content (e.g., Disk file uploads and User Fields), which is a common vector for indirect injection if not handled correctly.
Ingestion points: rules/disk.md (uploading files via uploadFile) and rules/left-menu.md (storing menu items).
Boundary markers: The skill includes explicit warnings that specific functions do not check permissions by default and requires developers to call canAdd(), canRead(), or CheckFields() beforehand.
Capability inventory: The skill describes capabilities for file writing to the Bitrix24 Disk and updating portal configuration settings.
Sanitization: It promotes the use of Bitrix24's native security context and access controllers.
[SAFE]: The skill demonstrates secure coding practices, such as using the allowed_classes => false option with PHP's unserialize function in rules/left-menu.md to mitigate object injection risks.
[SAFE]: No evidence of prompt injection, data exfiltration, or malicious persistence mechanisms was found. The skill operates within the documented scope of the Bitrix24 portal environment.

bitrix24-portal