The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill documents the use of drush php:eval to execute arbitrary PHP code blocks for direct configuration modification. This allows the execution of multi-line scripts provided within the skill instructions. Additionally, a Python one-liner is used to parse JSON data received from a network request.
[COMMAND_EXECUTION]: The skill makes extensive use of CLI commands via ddev drush for setting index configurations, clearing caches, and performing search queries.
[INDIRECT_PROMPT_INJECTION]: The skill describes patterns for querying search endpoints and processing the resulting data, which includes user-controlled fields such as entity titles and display names. This represents a potential surface for indirect prompt injection if the agent processes these results without sanitization.
Ingestion points: Output of curl requests to search endpoints (e.g., https://example.com/search-api/web-search) and drush search-api:search command outputs in SKILL.md.
Boundary markers: The skill does not provide specific delimiters or instructions to the agent to treat the retrieved search data as untrusted content.
Capability inventory: The skill utilizes drush config:set, drush php:eval, and drush config:export to modify the system state.
Sanitization: There is no evidence of sanitization or filtering of the search results before they are processed by the Python parsing script.
[EXTERNAL_DOWNLOADS]: The skill uses curl to fetch data from an external web endpoint for testing purposes. While the example uses a reserved domain (example.com), this pattern involves fetching and processing external data.

drupal-search-api