The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content such as task titles, descriptions, and error messages which are human-authored or generated by external tools. This creates an indirect prompt injection surface.
Ingestion points: Data is ingested through execute-sql (from system.tasks and system.task_runs), tasks-list, and tasks-retrieve.
Boundary markers: The skill explicitly instructs the agent to treat task text strictly as data and never as instructions or directives.
Capability inventory: The skill can emit and edit reports (emit_report, edit_report). It does not have arbitrary code execution or network exfiltration capabilities.
Sanitization: The skill employs several defensive measures, including using numeric fingerprints (cityHash64) in SQL queries to prevent string interpolation, and mandating validation of repository strings against a known-good cache (system.integration_repository_cache) before using them in commands or reports.
[DATA_EXPOSURE]: The skill identifies that error messages may contain sensitive data such as tokens or credentials in URLs. It includes explicit instructions to scrub keys, tokens, or URL credentials from any snippets included in reports.
[COMMAND_EXECUTION]: The skill recognizes a potential command injection risk when using repository names in templates like gh api. It provides clear mitigation steps to validate these strings against a trusted list of integrated repositories to prevent shell breakout.

signals-scout-tasks