The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes instructions for using ddev drush ev and grep to inspect routes and debug API behavior. These commands are typical for local development environments and are intended for administrative use by the developer.
[INDIRECT_PROMPT_INJECTION]: The PHP controller template parses external JSON data using $request->getContent(), which introduces a potential vector for indirect prompt injection if that data were later used in an LLM prompt. However, the template focuses on standard Drupal entity operations and includes basic input validation and access control logic.
Ingestion points: The actionName method in ApiController.php within SKILL.md ingests data via $request->getContent().
Boundary markers: Not present, as the template handles business logic rather than prompt interpolation.
Capability inventory: The controller demonstrates access to entity storage, cache invalidation (cache_tags.invalidator), and logging services (\Drupal::logger).
Sanitization: Includes checks for required keys in the JSON payload (e.g., isset($payload['required_field'])).

drupal-api-endpoints