The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes report summaries, findings, and work logs that are generated by signal clustering and agentic scouts (e.g., signals_scout). This creates an attack surface where instructions embedded in external data could influence the agent's behavior.
Ingestion points: Untrusted data enters the agent context through the inbox-reports-retrieve and inbox-report-artefacts-list tools, which return summaries and curated evidence (documented in SKILL.md).
Boundary markers: The skill provides explicit boundary instructions, stating that a report is a "diagnosis, not ground truth" and warns the agent to "Never implement a report's fix straight from its summary."
Capability inventory: The skill allows the agent to modify report states (inbox-reports-set-state), claim ownership (inbox-reports-claim), and update source configurations (inbox-source-configs-partial-update). It also encourages file system interaction and Pull Request creation.
Sanitization: No programmatic sanitization of the input text is described, but the requirement for manual verification against the codebase acts as a critical security control.

inbox-exploration