The Agent Skills Directory

[PROMPT_INJECTION]: Several files (e.g., assets/cli-auth-guardrail-tests.yaml, assets/guardrail-tests.yaml, and references/multi-turn-testing.md) contain prompt injection strings such as 'Ignore all your previous instructions'. These are explicitly used as test case utterances to verify that the agent's guardrails correctly intercept and block such attempts, rather than as instructions for the analyzing agent.
[CREDENTIALS_UNSAFE]: The skill manages External Client App (ECA) credentials for Salesforce API access. The hooks/scripts/credential_manager.py script implements secure local storage in ~/.sfagent/ using restricted file permissions (0600/0700) and automatically creates a .gitignore file to prevent accidental commits. It masks secrets in terminal output, following standard security practices for local credential management.
[INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface for indirect prompt injection (Category 8). It parses agent metadata (XML/DSL) in agent_discovery.py and YAML test scenarios in multi_turn_test_runner.py. While it lacks explicit boundary markers for this content, the ingestion is required for its primary purpose of analyzing and testing AI agents.
[DYNAMIC_EXECUTION]: Multiple Python scripts (hooks/scripts/multi_turn_fix_loop.py, hooks/scripts/run-automated-tests.py) use subprocess.run() to orchestrate CLI commands and other scripts. Analysis confirms that command arguments are passed as lists without shell=True, preventing shell injection vulnerabilities.

sf-ai-agentforce-testing