The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes a JSON configuration file (default post-copy-config.json) to drive API updates and Apex execution. This creates an attack surface where malicious instructions in the configuration data could influence agent behavior or target org state.
Ingestion points: The skill reads the user-provided JSON config file using the Read tool in Step 1 of the workflow.
Boundary markers: No specific boundary markers or "ignore" instructions are used for the file content, though the data is processed as structured JSON.
Capability inventory: The skill can perform record updates (PATCH) via sf api request rest and execute arbitrary Apex code via sf apex run (found in SKILL.md and references/scheduled_apex_path.md).
Sanitization: The skill employs dedicated Node.js scripts (scripts/build-scheduled-apex.mjs and scripts/soql-escape-job-name.mjs) to validate inputs and escape characters to prevent SOQL and Apex injection within the generated commands.
[DYNAMIC_EXECUTION]: The skill generates Apex code snippets at runtime from a local template (assets/scheduled_apex_template.apex) and executes them on the target Salesforce org using the sf apex run command.
Evidence: references/scheduled_apex_path.md (Step F-2 and F-3) describes the process of building the .apex file and executing it.
Mitigation: The generation is handled by a deterministic script (scripts/build-scheduled-apex.mjs) that implements strict validation (e.g., rejecting newlines and backslashes) and escaping for inputs like the JobName and CronExpression.

automation-sandbox-post-copy-configure