The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from multiple sources which could contain malicious instructions designed to subvert the agent's logic.
Ingestion points: Data is ingested from inbox-reports-retrieve (report titles and summaries), signal content stored in document_embeddings, and external responses from the GitHub API.
Boundary markers: While the skill includes an instruction to treat GitHub API responses as data rather than instructions, no specific delimiters or boundary markers are used when interpolating report titles or signal content into prompts or queries.
Capability inventory: The agent has extensive capabilities including execute-sql (reading sensitive events and embeddings), emit_report/edit_report (writing to the report channel), and outbound HTTP access.
Sanitization: There is no evidence of sanitization or escaping of the untrusted data before it is used in logic or forwarded to other tools.
[DYNAMIC_EXECUTION]: The skill dynamically constructs SQL queries for the execute-sql tool by interpolating strings from untrusted sources such as report IDs, titles, and signal metadata.
The instructions explicitly guide the agent to use cosineDistance with an embedding of <report title + gist>, where these strings are derived from untrusted report summaries. This creates a potential SQL injection surface if the input is not properly handled by the underlying tool.
[EXTERNAL_DOWNLOADS]: The skill is configured to perform outbound HTTP GET requests to the GitHub API (api.github.com) to retrieve pull request metadata.
These requests target a well-known service and are used for a legitimate purpose (verifying PR merge timestamps). The skill is instructed to treat these responses strictly as data.

signals-scout-inbox-validation