The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources and user logs, which creates a surface for indirect prompt injection attacks. Specifically, it reads remote error messages (latest_error) and user-authored SQL strings (query_log.query).
Ingestion points: Untrusted data enters the agent context via the latest_error field in system.source_schemas and external-data-schemas-list, as well as the query field in the query_log table and user-configured source/schema names/labels.
Boundary markers: The skill contains an explicit 'Untrusted data' section that instructs the agent to treat these values strictly as data to report and never as instructions, even if they appear to be commands. This serves as a significant boundary marker.
Capability inventory: The skill possesses the ability to execute SQL queries (execute-sql), author and edit reports (scout-emit-report, scout-edit-report), and persist state in a scratchpad (scout-scratchpad-remember).
Sanitization: The instructions recommend sanitization practices such as quoting snippets, truncating long messages, and dropping payload echoes before reporting findings.
[DYNAMIC_EXECUTION]: The skill provides instructions for generating SQL queries at runtime that interpolate user-controlled strings (table names) into the query body (e.g., in the multiSearchAnyCaseInsensitive probes). While intended for diagnostic purposes, maliciously crafted table names could theoretically influence the logic of these diagnostic queries if not properly handled by the agent's tool execution environment.

signals-scout-data-warehouse