The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents a pattern for a custom Drupal module that bypasses CSRF validation based on data received in request headers.
Ingestion points: The Authorization HTTP header is retrieved and parsed in the BearerSessionConfiguration.php code snippet to detect Bearer tokens.
Boundary markers: The provided documentation and code snippets do not include explicit delimiters or instructions for the agent to ignore potentially malicious content within the header values.
Capability inventory: The implementation decorates the core session_configuration service to allow requests to bypass CSRF checks, which is a security-sensitive operation.
Sanitization: The logic incorporates a call to isValidBearerToken to validate the token before allowing the bypass, which serves as the primary security control to prevent unauthorized access.

drupal-simple-oauth