The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains no instructions attempting to override agent behavior, bypass safety filters, or extract system prompts. The content is strictly limited to technical documentation and code examples.
[DATA_EXFILTRATION]: There are no patterns for accessing sensitive files (e.g., .env, .ssh) or exfiltrating data to external domains. Network references are limited to official Drupal documentation links, which are trusted sources.
[OBFUSCATION]: No obfuscated content, encoded strings, zero-width characters, or homoglyph attacks were detected in any of the files.
[REMOTE_CODE_EXECUTION]: The skill does not download or execute remote scripts. It references standard Drupal core dependencies (e.g., core/drupal, core/once) which are part of the local environment in the intended use case.
[COMMAND_EXECUTION]: No dangerous shell commands or subprocess calls are present. The PHP and JavaScript snippets provided are standard API implementations for the Drupal CMS.
[INDIRECT_PROMPT_INJECTION]: While the skill describes patterns for ingesting data (drupalSettings, AJAX responses), the examples use safe practices like textContent instead of innerHTML, and the skill itself does not have a mechanism to process untrusted data that could influence the AI's internal state.
[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file does not utilize any dynamic shell execution placeholders (!command).

drupal-javascript