The Agent Skills Directory

[DYNAMIC_EXECUTION]: The aiTransform BIF and the fluent .transform() method allow for the execution of logic at runtime through two main vectors: passing arbitrary closures (e.g., r -> r.trim()) and providing string-based class paths (e.g., aiTransform( "bxModules.bxai.models.transformers.TextCleanerTransformer" )) that the system loads and executes. This design facilitates dynamic code loading and execution within the pipeline workflow.
[INDIRECT_PROMPT_INJECTION]: The framework relies heavily on template interpolation to handle data between pipeline stages, creating a significant surface for indirect prompt injection.
Ingestion points: Untrusted data is ingested via the run(), stream(), and runAsync() methods (e.g., pipeline.run({ text: userContent })) and passed between steps using the ${_input} system variable.
Boundary markers: While the documentation mentions an addUntrusted() method to label content, the core examples demonstrate direct interpolation (e.g., ${text}, ${code}) without boundaries, which encourages unsafe practices.
Capability inventory: The pipeline has the ability to invoke various AI models via aiModel and execute arbitrary transformation logic via aiTransform (closures or classes).
Sanitization: There is no documentation of built-in sanitization or escaping for the standard ${} placeholder syntax, meaning attacker-controlled input could be interpreted as instructions by the downstream LLM.

bx-ai-pipelines