The Agent Skills Directory

[SAFE]: The skill is designed to enforce authorization and scope boundaries for security tasks. No malicious patterns such as prompt injection, obfuscation, or unauthorized data exfiltration were detected.
[EXTERNAL_DOWNLOADS]: The hackerone_program_lookup.py script fetches bug bounty program information from HackerOne's official GraphQL API. This is a well-known service, and the data retrieved is public program metadata used for scope verification.
[COMMAND_EXECUTION]: The skill executes local Python scripts (goal_workspace.py, hackerone_program_lookup.py, validate_program_records.py) to manage workspace organization and validate scope records. These operations are transparent and restricted to the local workspace environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes external program scope data retrieved from APIs. It implements basic ingestion boundaries by requiring verification against official sources and includes markdown escaping in the lookup script to mitigate potential injection risks from malformed external metadata.

engagement-scope