The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill correctly identifies that telemetry data (e.g., $host, $pathname, and URL parameters) is attacker-controllable and could contain malicious instructions or prompt injection attempts.
Evidence:
Ingestion points: The skill ingests untrusted data from the events table via $web_vitals properties, as well as from activity logs and deploy annotations.
Boundary markers: The instructions explicitly warn the agent to treat telemetry as "opaque data" and never as instructions.
Capability inventory: The skill uses execute-sql for data retrieval and scout-emit-report / scout-edit-report to generate findings, which could potentially persist injected content into an inbox.
Sanitization: The skill mandates the use of regex-based filtering (replaceRegexpAll) and length capping (substring) at the SQL layer to ensure only URL-safe characters enter the agent's context.
[SAFE]: The skill implements a verification step for repository mapping to prevent potential autostart/supply-chain attacks. It instructs the agent to only use repository links named by "trusted, human-authored sources" (like business knowledge or steering notes) rather than inferring them from telemetry data.
[SAFE]: The skill uses specialized platform tools (MCP) for its intended purpose of performance monitoring and report generation without requesting excessive privileges or accessing sensitive system files.

signals-scout-web-vitals