The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/gather-metadata.py uses subprocess.run to execute standard Git commands such as git remote get-url origin and git rev-parse --short HEAD. These operations are used solely to collect repository context for research document frontmatter and do not incorporate unvalidated user input.
[DATA_EXPOSURE]: The skill retrieves and logs technical metadata including the current working directory, repository URL, branch names, and commit hashes. This data is intended to provide traceability for research findings and is stored locally within markdown files.
[INDIRECT_PROMPT_INJECTION]: The skill features a "Research Memory" system that reads from previously generated markdown files in .research/ and ~/.research/ directories.
Ingestion points: Research content is loaded via scripts/read-research.py, scripts/search-research.py, and scripts/list-research.py.
Boundary markers: The instructions do not explicitly define delimiters for past research content when it is reintroduced into the agent context.
Capability inventory: The skill has the ability to execute local Python scripts, perform Git operations, and manage files (read, write, copy, move) within specific research directories.
Sanitization: scripts/read-research.py includes basic path validation to ensure file access is restricted to the designated project and global research folders.

researching-codebases