The Agent Skills Directory

[SAFE]: The skill serves as an instructional resource for Payload CMS development. It explicitly highlights critical security pitfalls for developers, such as the potential to bypass access control when using the Local API and the risk of breaking transaction atomicity in hooks if the request object is not properly propagated.
[INDIRECT_PROMPT_INJECTION]: The skill provides patterns for building applications (a CMS) that ingest and process external user data, which naturally creates a surface for indirect prompt injection. The skill documentation effectively addresses this risk by providing robust defensive patterns.
Ingestion points: User-defined fields within Collections and Globals as described in reference/COLLECTIONS.md and reference/FIELDS.md act as data input vectors.
Boundary markers: Detailed instructions in reference/ACCESS-CONTROL.md and reference/FIELDS.md provide implementation patterns for Access control and field validation logic to establish data boundaries.
Capability inventory: The skill documents capabilities including database CRUD operations (reference/QUERIES.md), file storage management through various adapters (reference/ADAPTERS.md), and the creation of custom REST API endpoints (reference/ENDPOINTS.md).
Sanitization: Comprehensive guidance is provided on using field-level validation hooks and role-based access control (RBAC) to ensure that all data is validated and that operations are restricted to authorized users.

payload