The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructions and provided assets (e.g., assets/example-system-context-read-subflow.flow-meta.xml and assets/example-system-context-write-flow.flow-meta.xml) explicitly use the SystemModeWithoutSharing configuration. This setting allows the flows to operate with system-level permissions, bypassing Salesforce's record-level sharing rules and granting the agent broader data access than the executing user would typically have.
[INDIRECT_PROMPT_INJECTION]: The skill implements a pattern where data queried from records is directly concatenated into the prompt response instructions without sanitization or escaping. For instance, in assets/example-promptflow-thin-wrapper.flow-meta.xml, the content of the claimsText variable (which includes fields like 'Summary' from the database) is added to the $Output.Prompt instructions. This creates a surface where instructions embedded within record data could be interpreted by the LLM.
[INDIRECT_PROMPT_INJECTION]: Mandatory Evidence Chain:
Ingestion points: The flow in assets/example-system-context-read-subflow.flow-meta.xml queries ClaimParticipant and related Claim records using the Get_Open_Claims recordLookup element.
Boundary markers: The wrapper flow in assets/example-promptflow-thin-wrapper.flow-meta.xml includes a text intro block in the Add_Intro_And_Claims assignment, but it lacks strict delimiters or specific instructions to the model to ignore instructions embedded within the retrieved data.
Capability inventory: The skill utilizes Salesforce recordLookups, recordCreates, and subflow execution capabilities.
Sanitization: There is no evidence of sanitization, filtering, or validation of the record fields (such as Summary or ClaimReason) before they are appended to the agent's prompt instructions.

building-system-context-agent-data-flows