The Agent Skills Directory

[DATA_EXFILTRATION]: The skill facilitates data extraction through the use of frappe.get_all, which is explicitly documented to bypass the Frappe framework's permission system.
Evidence: The instruction in SKILL.md states: "List query (ignores permissions) ... frappe.get_all('Sales Order', ...)" and references/jinja.md reinforces this: "get_all: ignores permissions".
Risk: This capability allows the agent to access and potentially exfiltrate data from any document type in the database, regardless of the active session's restrictions.
[PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection by rendering untrusted data from document fields directly into templates.
Ingestion points: Document fields such as doc.customer, doc.items, and doc.terms within SKILL.md.
Capability inventory: Access to frappe.sendmail for automated communication and frappe.get_all for broad data access across the system.
Sanitization: Although the skill advises escaping user content in its guardrails section, it also demonstrates the |safe filter in both SKILL.md and references/jinja.md, which explicitly disables the framework's built-in XSS and injection protections.
Boundary markers: Delimiters are not used to separate untrusted data from the instructions, allowing for potential manipulation of the template logic via content stored in the database.

printing-templates