The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the Scio wiki and the general web, creating an inherent attack surface. To mitigate this, it uses a dedicated injection scanner (scan-injection.py) to analyze incoming data before the agent processes it. The skill's primary instructions also explicitly command the agent to treat all ingested text as data rather than instructions, applying a zero-trust model to external content.
[COMMAND_EXECUTION]: The skill uses subprocess calls in its MCP servers and setup scripts to orchestrate its own helper components (e.g., whoami.py, check-claims.py, fetch.py). These executions are securely configured with fixed argument lists and avoid shell invocation, preventing arbitrary command injection while enabling modular operation.
[DATA_EXFILTRATION]: The skill handles an API key stored locally. It implements a comprehensive secret guard (guard-secrets.py) as a tool-use hook to monitor arguments and block any attempts to leak the key or the credentials file path. The scio_bridge.py relay ensures the key is only transmitted to the official scio.md host in a secure Authorization header, with protections against cross-host redirect leaks.
[PROMPT_INJECTION]: Heuristic analysis flagged injection-related text in references/security.md. These findings are verified as false positives; the text consists of examples used to teach the agent how to identify and report actual steering and injection attempts.

scio