The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill performs network requests to api.tavily.com via the tavily-search.mjs script. This is a well-known AI search service utilized for the skill's primary research purpose.
[COMMAND_EXECUTION]: The agent is instructed to execute a local script (scripts/tavily-search.mjs) to conduct web searches. The script uses standard Node.js libraries and does not involve unsafe dynamic code execution like eval or exec.
[DATA_EXFILTRATION]: The skill accesses a local .env file to retrieve the TAVILY_API_KEY. It includes explicit instructions for the user to manage this file safely and ensures the key is not logged or committed to version control.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the web and GitHub and passes it to subagents for analysis, creating a potential surface for indirect prompt injection.
Ingestion points: External content is gathered from the web (via Tavily and WebFetch) and GitHub (via MCP tools).
Boundary markers: No specific delimiters or markers are defined for isolating external content when it is interpolated into subagent prompts.
Capability inventory: The agent can execute local scripts, perform network operations, and write brief files to the .octocode/ directory.
Sanitization: The skill does not implement explicit sanitization of the external content before passing it to the subagents, which is a common characteristic of research-based AI skills.

octocode-brainstorming