The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from session recordings and outputs from other LLM scanners, which constitute untrusted external data that could contain malicious instructions.
Ingestion points: The skill reads scanner_output_* properties (confidence, verdict, score, tags, title, summary, reasoning) from $recording_observed events via execute-sql and uses the vision-scanners-observations-list tool to retrieve potentially adversarial LLM-generated text.
Boundary markers: The skill includes a dedicated 'Untrusted data' section explicitly instructing the agent to treat scanner output strictly as data and never as instructions, even if the text resembles commands.
Capability inventory: The agent has the ability to read data via SQL, write reports to an inbox (emit_report, edit_report), and potentially modify or create scanners (vision-scanners-update, vision-scanners-create) if granted specific write permissions.
Sanitization: The instructions require the agent to sanitize identifiers (slugification) and truncate untrusted prose snippets before inclusion in reports or memory.

signals-scout-replay-vision