The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes Git commands (e.g., git worktree, git commit) and Node.js scripts (validate-html.ts, scaffold-html.ts) to manage isolated research environments and validate generated reports. These operations are scoped to the project workspace and authorized tasks.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data during the scraping and research phases, which represents a potential injection surface. It mitigates this risk through a rigorous manual reconciliation process (evidence ledger) and a technical validation layer that ensures generated HTML reports are self-contained and free of external script runtimes.
[DYNAMIC_EXECUTION]: The skill uses Node.js internal modules such as vm and child_process to perform syntax checks and safety validation on generated HTML and JavaScript code. This is implemented as a security measure to verify that the agent's output adheres to the required portability and safety standards.
[EXTERNAL_DOWNLOADS]: The skill facilitates the scraping of HTTP and HTTPS resources for research purposes. It includes defensive measures such as path normalization to prevent directory traversal and explicit instructions to treat all fetched content as untrusted evidence rather than instructions.

ptlam-researching