The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The gather-metadata.py script executes git remote get-url origin to populate the repository field in research document metadata. If a user has configured their local git remote with an embedded authentication token or credential (e.g., https://<token>@github.com/user/repo), these secrets will be saved in plain text within the research files located in .research/ or the user's home directory ~/.research/.
[COMMAND_EXECUTION]: The gather-metadata.py script utilizes subprocess.run to call the local git binary for retrieving repository state (branch, commit, remote URL). While this executes shell commands, the script correctly uses argument lists and avoids shell=True, which is a safe implementation pattern for invoking system tools.
[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection because it coordinates agents that ingest and reason over untrusted data from both the local codebase and the web.
Ingestion points: Files retrieved from the local filesystem via read, grep, and glob tools, as well as external web content fetched by the web-searcher agent using webfetch.
Boundary markers: The agent prompts do not utilize explicit delimiters or unique markers to wrap external data, which may allow malicious content within a file or webpage to influence sub-agent behavior.
Capability inventory: The agents have the capability to perform extensive filesystem searches and external network fetches.
Sanitization: There is no evidence of filtering or sanitizing external content before it is provided to the LLM agents for synthesis.

researching-codebases