The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs shell operations to manage the research workflow.
The script scripts/compile_report.mjs utilizes execSync to open the generated HTML report in the user's browser, which is a standard functional requirement for this tool.
The script scripts/extract_page.mjs uses execFileSync to interact with the bb (Browserbase) CLI, which is more secure than shell-spawning alternatives as it prevents shell injection by passing arguments directly.
[EXTERNAL_DOWNLOADS]: The skill interacts with external network resources as part of its primary function.
It performs web searches via bb search and fetches page content using bb fetch and bb browse to enrich company data.
These operations are legitimate and necessary for the stated purpose of company research.
[PROMPT_INJECTION]: The skill manages a significant surface for Indirect Prompt Injection since it processes content from arbitrary external websites.
Ingestion points: Untrusted data enters the agent context through extract_page.mjs and Browserbase search results.
Boundary markers: The skill includes 'Anti-hallucination rules' in SKILL.md and references/workflow.md that explicitly instruct the agent to ignore cosmetic site features and ground findings in specific extracted text.
Capability inventory: The skill uses subprocess calls to bb, mkdir, sed, and cat to manage files and network fetches.
Sanitization: The compile_report.mjs script implements an escapeHtml function to sanitize data before embedding it into the final HTML report, reducing XSS risks.

company-research