The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides examples of using PHP's unserialize() function to handle data stored in Redis caches (references/advanced.md). While a common pattern for object persistence in PHP, unserialize() can be risky if the underlying storage is compromised, as it could lead to object injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill instructs on building storefront controllers, event subscribers, and API routes that ingest external data from HTTP requests (references/security.md, references/storefront.md, references/api.md). This establishes an attack surface for indirect prompt injection where untrusted data (e.g., headers, POST bodies) enters the application context.
Ingestion points: Data enters through storefront controllers and API endpoints defined in the reference materials.
Boundary markers: The skill advocates for the use of delimiters and proper escaping in Twig templates to separate data from instructions.
Capability inventory: The skill uses EntityRepository for database operations and Flysystem for file storage, which are powerful capabilities if combined with unsanitized input.
Sanitization: There is significant emphasis on using Symfony's ValidatorInterface and Shopware's DataValidator for boundary validation, alongside CSRF protection and SQL injection prevention via the Data Abstraction Layer (DAL).
[COMMAND_EXECUTION]: The skill lists standard development and maintenance commands using bin/console, composer, and npm for installing plugins, running migrations, and building assets.
[EXTERNAL_DOWNLOADS]: The skill references the use of composer and npm for managing project dependencies and refers to official Shopware schema files hosted on GitHub for manifest validation.

shopware6