The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes live call transcripts, which are untrusted external inputs. A malicious caller could attempt to influence the AI's data extraction by speaking instructions intended to override the system prompt (e.g., instructing the AI to set a specific field value regardless of the actual conversation).
Ingestion points: The transcript parameter in the buildPrompt Apex method (Reference.md) and the lightning/voiceToolkitApi source used by the Lightning Web Component.
Boundary markers: The prompt construction uses structural headers such as CALL TRANSCRIPT: and QUESTIONS TO ANSWER: to delimit untrusted data from instructions.
Capability inventory: The skill has the capability to upsert records to any Salesforce SObject and field specified in the Intake_Template__c and Intake_Question__c configuration records.
Sanitization: The AI is strictly instructed to respond only with a valid JSON object. The LWC runtime filters the AI results against a set of currently visible fields, preventing the AI from populating hidden fields. Apex code uses escapeIdentifier for dynamic SOQL queries to prevent injection.
[DYNAMIC_EXECUTION]: The skill uses dynamic SObject instantiation and field population based on administrative configuration records.
Evidence: The submitToTargetObject method in SKILL.md uses Schema.getGlobalDescribe().get(objApi).newSObject() and record.put(field, value) to dynamically create and populate records. While this is a standard Salesforce design pattern, it relies on the integrity of the configuration metadata records managed by the Intake_Builder_Admin role.

sf-service-ai-intake