The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to interact with local CLI utilities such as gh, yt-dlp, and grok for research tasks. It also uses it in diagnostic scripts (doctor_yichen.py) to verify tool availability. The diagnostic logic is designed with security in mind, utilizing a filtered environment (safe_metadata_environment) to prevent the exposure of sensitive API keys or credentials to sub-processes.
[INDIRECT_PROMPT_INJECTION]: As an internet research tool, the skill is designed to ingest and process content from a variety of external websites and social platforms. This creates a surface for indirect prompt injection. The skill mitigates this risk by enforcing a 'hengzong research' protocol, which requires the agent to verify claims against original sources and follow a structured evidence-gating process before generating a final report.
[DATA_EXPOSURE]: The diagnostic script (doctor_yichen.py) inspects specific local paths such as ~/.grok/auth.json and ~/.config/agent-secrets/firecrawl-api-key to check if necessary backends are configured. The script is restricted to checking file existence and metadata (like permissions and size) and explicitly avoids reading or printing the actual contents of these sensitive files.

yichen-web-research