The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user-authored content from task descriptions and error messages, creating a surface for indirect prompt injection.
Ingestion points: Data is pulled from system.tasks and system.task_runs using execute-sql (as defined in references/queries.md), and via the tasks-list and tasks-retrieve tools.
Boundary markers: The skill lacks explicit structural delimiters (such as XML tags or designated separators) for wrapping untrusted data, although it provides strong natural language instructions to treat input as data rather than directives.
Capability inventory: The agent has access to emit_report, edit_report, execute-sql, and several scout-scratchpad memory tools for summarizing and persisting findings.
Sanitization: The instructions mandate summarizing themes instead of quoting text, scrubbing credentials (tokens, keys, or URL credentials) from error messages before reporting, and validating repository strings before use.
[COMMAND_EXECUTION]: The skill identifies a potential command injection path where malicious repository names in task data could compromise shell commands or API calls.
Evidence: The skill explicitly warns the agent against pasting unvalidated repository strings into commands (such as gh api templates), instructing it to verify strings against a trusted system.integration_repository_cache and use numeric fingerprints generated via cityHash64 in SQL queries to prevent string-based breakout attacks.

signals-scout-tasks