The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes user-controlled data from external sources.
Ingestion points: The skill reads untrusted text from experiment titles, descriptions, and feature flag metadata via experiment-get and experiment-list tools.
Boundary markers: There are no explicit instructions or delimiters provided to help the agent distinguish between data and potential instructions embedded within the experiment names or descriptions.
Capability inventory: The agent has the ability to execute database queries via execute-sql, write to a shared scratchpad, and author human-visible reports using scout-emit-report.
Sanitization: The instructions do not specify any validation, escaping, or filtering of the content retrieved from the experiment management system before it is used in logic or report generation.
[COMMAND_EXECUTION]: The skill frequently uses the execute-sql tool to analyze experiment exposure data.
The instructions provide specific SQL templates for counting exposures and identifying identity fragmentation.
While the skill includes guidance on managing timezone discrepancies and sample-size gates, the availability of a tool that executes arbitrary SQL against the project's events table represents a high-privilege capability that could be misused if the agent's instructions are compromised.

signals-scout-experiments