The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the execFileSync method to execute system commands for its core functionality.
Evidence: scripts/core/providers.mjs executes curl and npx mcporter to communicate with research providers.
Evidence: scripts/core/providers.mjs executes node to run a local manus_client.mjs script for asynchronous tasks.
[EXTERNAL_DOWNLOADS]: The skill fetches content from external research and grounding services.
Evidence: scripts/core/providers.mjs performs HTTP GET and POST requests to api.search.brave.com and generativelanguage.googleapis.com (Google Gemini).
Evidence: External data is retrieved via the mcporter tool from Tavily's search and extract APIs.
[DATA_EXFILTRATION]: User-provided research goals and queries are transmitted to external service providers.
Evidence: Research queries are sent to Brave and Google APIs via scripts/core/providers.mjs to retrieve search results and grounding data.
[PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes untrusted data from the internet.
Ingestion points: Untrusted web snippets are ingested into the evidence ledger in scripts/core/retrieval.mjs.
Boundary markers: The system uses a structured JSON ledger, but snippets from external URLs are presented to the agent as natural language content without explicit delimiters.
Capability inventory: The skill possesses command execution capabilities (via curl and npx) and network access.
Sanitization: There is no evidence of sanitization or instructions to ignore embedded commands within the retrieved web content before processing.

research