The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes $csp_violation event data from untrusted external sources (web browsers/users). This data includes fields like $csp_blocked_url and $csp_original_policy which could be manipulated by an attacker to include malicious instructions or false information designed to influence the agent's behavior.
Ingestion points: Data is ingested via execute-sql queries against the events table in SKILL.md.
Boundary markers: The skill does not define specific string delimiters for the untrusted data, but it uses SQL grouping and aggregation to identify patterns.
Capability inventory: The skill has access to analytics tools (execute-sql), source code inspection (gh, grep), and reporting tools (emit_report, edit_report).
Sanitization: The skill explicitly warns the agent that client-reported data is unauthenticated and can be forged. It mandates that the agent reconcile telemetry findings against the code (source of truth) before proposing any policy changes. This verification step is a primary safeguard against automated exploitation of the agent.
[COMMAND_EXECUTION]: The skill utilizes command-line tools such as gh (GitHub CLI), grep, and base64 to verify CSP configurations against the source of truth in code repositories. These commands are integral to the skill's function and include instructions to derive target parameters from trusted sources rather than untrusted telemetry.

signals-scout-csp-violations