Forward prompt and selected skills to the agent-scan scanner

[stanleys12]

Summary

The agent_scan task API took prompt but never passed it to agent-scan's main.py, so it did nothing. Now it gets forwarded as -p. I also added an optional skills array to the request. It's checked against the known detection skills and forwarded as --skills, so you can run a subset instead of all 10.

Type of change

• Bug fix
• New feature
• Documentation

How was this tested?

Unit tests in common/agent cover the argv with and without prompt and skills. Unit tests in common/websocket cover skills validation. go build ./... works.

I updated api.md, api_zh.md and api_ja.md, plus the handler's swagger @Description example (mirrored in docs/swagger.json and docs/docs.go), to document prompt and skills. docs/swagger.yaml has no Agent Scan example, so I left it alone.

I used Claude for parts of this and reviewed the result myself.

Related issue

Related to #435

Checklist

• go build ./... succeeds locally
• I followed the existing file/rule format conventions for this contribution type
• I have not introduced hardcoded secrets or credentials

[boy-hack]

Verified locally on head 5d349817 (isolated worktree):

• go build ./... / go vet ./... clean
• common/agent and common/websocket tests pass, including the new argv construction and skills-validation cases
• Cross-checked the AgentScanSkills allowlist against _DETECTION_SKILLS in agent-scan/agent_scan/core/agent.py — all 10 names match exactly
• Confirmed main.py accepts both -p/--prompt and --skills (comma-separated, defaults to all skills); --opt=value style works fine with argparse
• Prompt plumbing verified end to end: websocket maps req.Prompt into task Content, agent_task.go forwards it as --prompt=; skills rides in the task params map and unknown names fail fast with a clear API error

Review notes:

• The Go allowlist must track the Python _DETECTION_SKILLS list (the sync comment is good). If a detection skill is added on the Python side, the API will reject it until the Go list is updated — acceptable while the list is stable, worth a follow-up if it starts churning.
• Backward compatible: omitted skills → no --skills flag → all skills run, same as today.

One heads-up: #702 just merged and also touches common/agent/tasks_test.go, so this branch likely needs a rebase before merge. CI has not reported on this head yet; once it is green post-rebase, this looks good to go.

No blocking change requests.

[stanleys12]

Thanks for checking it. I merged main into the branch. The only conflict was in common/agent/tasks_test.go, where both sides had added new tests, and I kept all of them.

The merge also brought in #429, which adds memory-rag-poisoning-detection to _DETECTION_SKILLS. That would have made the Go allowlist reject the new skill, so in 223faff I added it to AgentScanSkills and to the skills row in api.md, api_zh.md and api_ja.md. The Go list matches the Python one again (11 entries). common/agent and common/websocket tests pass after the merge.

[boy-hack]

Re-verified on the updated head 223faff8 (main merge + memory-rag-poisoning-detection added to the whitelist):

• go build ./... / go vet clean; common/agent + common/websocket tests pass.
• The Go AgentScanSkills whitelist (11 entries) now matches Python _DETECTION_SKILLS one-to-one, including the newly registered memory-rag-poisoning-detection.
• Merge sim against current main is clean.

One blocker: the CI pipeline has never reported a check-run on this PR (0 check-runs, combined status pending) — likely the trigger was missed around the force-push window. Could you retrigger it (e.g. push an empty commit or close/reopen the PR)? Once CI is green this is good to merge.