The Agent Skills Directory

[COMMAND_EXECUTION]: The code example in UserRepository.repository.ts demonstrates an insecure SQL query construction pattern. The findAll method uses string interpolation (query += ORDER BY ${options.sort} ${options.order}``) for sorting parameters. If these parameters are derived from user-controlled input (such as the req.query objects shown in the UsersController), the application would be vulnerable to SQL injection, as database drivers typically only support parameterization for values, not for structural elements like column names or sort directions.
[PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection by handling untrusted external data from API requests and webhooks.
Ingestion points: The listUsers and createUser methods in UsersController ingest data from Express Request query and body objects. The WebhookHandler processes data from Stripe webhook payloads.
Boundary markers: While the code refers to a validateRequest middleware, no implementation is provided to demonstrate sanitization, escaping, or strict schema validation that would prevent embedded instructions from influencing agent behavior.
Capability inventory: The skill has the capability to perform database operations (client.query) and interact with external services (e.g., EmailService, JobQueue).
Sanitization: The provided patterns lack explicit sanitization or filtering logic for the ingested data before it reaches database or service execution points.

Integration Patterns