The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data authored by users, including task titles, descriptions, and error messages which could contain malicious instructions.
Ingestion points: Content is ingested from system.task_runs.error_message via SQL queries and from tasks.title and tasks.description through the tasks-list and tasks-retrieve tools.
Capability inventory: The skill has the ability to write to the platform's report channel using emit_report and edit_report, and the agent may have access to shell commands or Git tooling as suggested by warnings regarding the gh api command.
Sanitization: The skill contains explicit, robust instructions to treat task text strictly as data, summarize themes in the agent's own words rather than quoting descriptions, and limit any quoted text to short, truncated snippets.
Boundary markers: The skill relies on platform-level visibility checks (task_visibility_q) and instructions to exclude internal project data via SQL filters.
[COMMAND_EXECUTION]: The skill identifies and mitigates a command injection risk stemming from untrusted repository names.
Evidence: The instructions warn that repository values found in task data may contain shell-breaking characters (e.g., $(...)). It mandates that any repository string must be validated against a known-safe list in system.integration_repository_cache before being used in any shell command or project report.
[DATA_EXFILTRATION]: The skill recognizes that system error messages often inadvertently capture sensitive information like authentication tokens or URL credentials.
Evidence: The instructions explicitly require the agent to scrub anything shaped like a token, key, or credential from the error_message content before including it in any report evidence, preventing accidental exfiltration of secrets to the report channel.

signals-scout-tasks