The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements logic to ingest and process claims (email, roles, verified status) from external identity providers (OIDC/OAuth).
Ingestion points: The BackOfficeSsoRules.Apply and MemberSsoRules.Check methods in the skill's assets process ExternalLoginInfo claims at runtime.
Boundary markers: SKILL.md provides explicit instructions to validate claims and restrict access based on verified identity.
Capability inventory: The skill uses user.AddRole, user.IsApproved, and role synchronization to manage Umbraco user and member identities.
Sanitization: The provided C# assets include mandatory checks for the email_verified claim, email domain filtering, and explicit mapping of external roles to internal group aliases.
[CREDENTIALS_UNSAFE]: Hardcoded credentials and secrets are present within the evals/ testing directory.
Evidence: evals/files/okta-backoffice/appsettings.json contains a hardcoded ClientSecret value.
Context: As documented in evals/README.md, these are deliberate defects intended for evaluation scenarios and are not part of the production code templates in the assets/ folder.
[EXTERNAL_DOWNLOADS]: The skill instructions and evaluation files reference external dependencies and content delivery networks.
Evidence: references/members.md and references/users.md direct users to add the Microsoft.AspNetCore.Authentication.OpenIdConnect package from the official NuGet registry.
Evidence: evals/files/google-members/Views/Partials/Login.cshtml includes standard library scripts hosted on cdnjs.cloudflare.com.
Context: These resources originate from well-known and trusted providers for software development.

umbraco-security-external-logins