The Agent Skills Directory

[SAFE]: A detailed review of the skill instructions and Python scripts found no evidence of prompt injection, code obfuscation, or malicious intent. The skill adheres to established security best practices for handling research data and user configurations.
[COMMAND_EXECUTION]: The use of __import__ in scripts/fetch_icsid_award.py was evaluated and found to be benign. It is used within the --check-env function to verify the presence of required Python packages (requests, pdfplumber, openpyxl) by attempting to import them from a predefined list of literal strings.
[EXTERNAL_DOWNLOADS]: The skill downloads PDF research documents and metadata from well-known international organization domains, including worldbank.org (ICSID), unctad.org (UNCTAD), and pca-cpa.org (PCA). These sources are reputable, the downloads are necessary for the skill's stated purpose, and the process includes a manual confirmation step where the agent verifies the document's identity before processing.
[DATA_EXFILTRATION]: File system and network operations are legitimate and scoped to the skill's intended workflow. The skill writes research memos and retrieved PDFs to a directory explicitly provided by the user and maintains a local configuration file for storing user preferences like language and folder paths. No attempts to access sensitive system files or exfiltrate private data were found.

isds-research