The Agent Skills Directory

[COMMAND_EXECUTION]: The skill attempts to execute bash scripts located at $HOME/.claude/scripts/codex-research.sh and $HOME/.claude/scripts/lib/obsidian-export.sh. These scripts are external to the skill package and their security posture cannot be verified statically.
[DATA_EXFILTRATION]: Research artifacts and findings are transmitted to external services including Perplexity, Exa, and Codex for verification and processing. While these are presented as research tools, they represent a data flow to external infrastructure.
[DATA_EXPOSURE]: The skill contains a hardcoded user-specific file path for memory synchronization: ~/.claude/projects/-Users-nmaximov/memory/. This may lead to unexpected behavior or failures on systems with different directory structures.
[REMOTE_CODE_EXECUTION]: The skill uses source to load and execute the contents of $HOME/.claude/scripts/lib/obsidian-export.sh into the current shell environment, which is a high-risk operation for externally sourced scripts.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection.
Ingestion points: The skill scrapes over 150 untrusted external sources into the .firecrawl/research/ directory.
Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands when the agent reads this data in the 'Fact-checker' or 'Critic' phases.
Capability inventory: The agent has the ability to execute shell commands (via Pandoc and bash scripts) and write files to the local system.
Sanitization: No sanitization or filtering of scraped content is performed before it is passed to subsequent agent roles for synthesis.

ultra-research