The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements patterns for processing untrusted external data via HTTP request bodies, parameters, and query strings, which represents a potential attack surface if the agent processes malicious data through these APIs.
Ingestion points: UserController.ts and Fastify route handlers in resources/implementation-playbook.md ingest data from req.body, req.params, and req.query.
Boundary markers: The skill does not explicitly define boundary markers for agent-user interactions, but it provides architectural layers (Controllers/Services/Repositories) to isolate and control data flow.
Capability inventory: The code samples include database write/read operations (pg, mongoose), authentication token generation (jsonwebtoken), and structured logging (pino).
Sanitization: The playbook includes a dedicated 'Validation Middleware' section using Zod for schema enforcement and uses bcrypt for secure password hashing.
[DYNAMIC_EXECUTION]: The UserRepository.update implementation in resources/implementation-playbook.md utilizes dynamic string concatenation to build SQL SET clauses from object keys.
Evidence: The repository layer code iterates through Object.keys(updates) to generate the setClause in an UPDATE query. While query values are properly parameterized, the column names (keys) are interpolated directly into the query string. This pattern is safe only when used in conjunction with the strict upstream Zod validation demonstrated in the skill's middleware section.

nodejs-backend-patterns