The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves data from a Salesforce organization using sf data query and uses these values to modify Flow metadata before deployment. This creates an indirect prompt injection surface where a malicious user with control over organization metadata (e.g., Queue labels or DeveloperNames) could potentially inject instructions into the Flow XML.
Ingestion points: Salesforce record data queried in Step 1 and Step 3 of the procedure in SKILL.md.
Boundary markers: None present; data is interpolated directly into templates.
Capability inventory: Capability to read from the org (sf data query), write to the file system (sed, cp), and deploy metadata (sf project deploy).
Sanitization: No sanitization is performed on the results of the sf data query before they are used in sed replacement operations.
[DYNAMIC_EXECUTION]: The skill uses sed to dynamically modify XML templates (located in assets/) with organization-specific IDs and labels at runtime. This generated metadata is then executed/deployed to the target environment using sf project deploy. While this is a standard automation practice for Salesforce development, it falls under the category of script generation and execution.

replicating-omnichannel-routing-flows