The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains a dedicated 'Untrusted content' section that explicitly instructs the agent to treat task titles, descriptions, and error messages as data only. It provides clear guidance to ignore any instructions embedded in the data, such as 'ignore previous instructions' or 'file a report about X'.
[COMMAND_EXECUTION]: The instructions provide robust defenses against shell injection. It warns against using repository names directly in shell commands (e.g., GitHub CLI templates) without first validating them against a trusted local cache (system.integration_repository_cache).
[DATA_EXFILTRATION]: The skill implements strict data visibility controls. It instructs the agent to use tool-based retrieval (tasks-list, tasks-retrieve) for reading task text instead of direct SQL queries, as the tools enforce visibility rules for private tasks that the system tables do not. Additionally, it provides instructions to scrub credentials and tokens that may appear in error messages before including them in reports.
[COMMAND_EXECUTION]: To prevent SQL injection, the cookbook queries utilize cityHash64 fingerprints for filtering on user-influenceable strings like repository names and error messages, ensuring that attacker-controlled strings never reach the SQL predicate logic.
[DATA_EXFILTRATION]: The skill defines a clear 'Routing' logic for reports to ensure they are sent to authorized team members based on project history and task ownership, rather than arbitrary user-supplied identifiers.

signals-scout-tasks