The Agent Skills Directory

[COMMAND_EXECUTION]: The initialization scripts (src/server-init.ts and scripts/server-init.js) spawn a detached Node.js process to run the research server. This is a standard architectural pattern for local services, allowing the server to persist across agent turns while self-managing its lifecycle with an idle timeout.
[EXTERNAL_DOWNLOADS]: The skill performs search operations against the GitHub API and the npm registry. These are well-known technology services, and the interactions are limited to the intended research functionality of the tool.
[DATA_EXFILTRATION]: The skill records de-identified telemetry (such as tool usage counts and error rates) for diagnostics. This behavior is disclosed in the README, and users can opt out by setting the LOG environment variable to false.
[CREDENTIALS_UNSAFE]: The skill implements proactive security measures in src/utils/logger.ts by redacting sensitive keys (e.g., 'token', 'api_key', 'password') from the log files stored in the user's home directory.
[SAFE]: The skill includes comprehensive documentation on security guardrails (references/GUARDRAILS.md), explicitly instructing the agent to treat all external source code as untrusted data and to ignore any commands or instructions embedded in code comments, which effectively addresses potential indirect prompt injection vectors.

octocode-research