The Agent Skills Directory

[SAFE]: The skill is a set of documentation and coding guidelines for Frappe API development. It includes multiple 'Guardrails' and 'Common Mistakes' sections that explicitly warn against SQL injection, unauthorized access, and unsafe data handling.
[PROMPT_INJECTION]: No attempts to override agent behavior or bypass safety guidelines were detected. The instructions follow standard educational patterns.
[DATA_EXFILTRATION]: While the skill describes how to build APIs that transfer data, it consistently instructs the use of authentication headers (API Key/Secret, Bearer Tokens) and permission checks (frappe.has_permission) to prevent unauthorized data exposure.
[COMMAND_EXECUTION]: The skill mentions standard Frappe 'bench' CLI commands in documentation for site configuration and debugging (e.g., bench --site <site> console). These are context-appropriate for developers and do not represent malicious execution.
[OBFUSCATION]: A Base64-encoded string is used in references/authentication.md as an example of a Basic Auth header (YTFiMmMzZDRlNWY2Onh5ejc4OWFiYzEyMw==). It decodes to dummy credentials (a1b2c3d4e5f6:xyz789abc123) and is used for illustrative purposes only.
[INDIRECT_PROMPT_INJECTION]: The skill documents how to handle external data via webhooks and custom RPC endpoints, which creates an attack surface for indirect injection. However, it mitigates this by providing mandatory evidence of boundary markers:
Ingestion points: Webhooks (references/webhooks.md) and custom RPC endpoints (SKILL.md).
Boundary markers: Explicit instructions to use frappe.has_permission() and frappe.throw() for validation in every endpoint (SKILL.md, references/permissions.md).
Capability inventory: Documents usage of doc.save(), frappe.enqueue (background jobs), and frappe.sendmail (email).
Sanitization: Recommends frappe.db.escape() for SQL queries and explicitly advises against using eval() or dynamic code execution in its guardrails.
[DYNAMIC_EXECUTION]: The skill documents the 'Server Script' feature of Frappe in references/server-scripts.md, which allows executing Python at runtime. It correctly notes that this feature uses RestrictedPython for safety and is disabled by default in production environments.

api-development