The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation (README.md and requirements.txt) encourages users to install search-cli as a primary search provider via a third-party Homebrew tap (199-biotechnologies/tap). This source is not recognized as a trusted organization or well-known service, posing a supply chain risk.
[DATA_EXFILTRATION]: By default, the skill automatically synchronizes and publishes generated research reports to a public blog (lovstudio.ai/blog) upon completion. This 'public by default' behavior creates a significant risk of accidental data exposure if the research contains sensitive or proprietary information from the user's environment.
[COMMAND_EXECUTION]: The skill uses local shell commands to execute the search-cli tool and to perform the automated synchronization to the blog system via pnpm run sync:research (SKILL.md). While functional, these automated execution paths increase the local attack surface.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a broad attack surface for indirect prompt injection due to its core function of retrieving and processing external data.
Ingestion points: The skill fetches vast amounts of untrusted content from the web, including search snippets, academic papers, and repository metadata across multiple forges (Phase 3: RETRIEVE in methodology.md).
Capability inventory: The agent has the capability to write files, execute scripts, and perform network operations to publish content.
Sanitization: The provided scripts (validate_report.py, verify_citations.py) focus on validating the structure and metadata of the final report rather than sanitizing the retrieved external content for embedded malicious instructions.
Boundary markers: The instructions for Phase 3 and the sub-agent prompts lack explicit delimiters or instructions to the LLM to ignore potentially malicious embedded content in the retrieved data.

deep-research