The Agent Skills Directory

[Subprocess Execution]: The skill uses subprocess.Popen to execute its internal search workers in parallel. This improves performance and provides process isolation for different search connectors. The commands are constructed using a list format with explicit arguments, which is a secure practice to prevent shell injection.
[Environment Variable Loading]: The skill includes a custom utility to search for and load .env files from the project structure. This is used to manage API credentials (e.g., for OpenReview or Semantic Scholar) and follows standard development practices for secret management, using os.environ.setdefault to ensure that existing environment variables take precedence.
[Dynamic Module Loading]: The search aggregator uses importlib.import_module to lazily load search connector scripts. This modular approach allows the skill to function even if specific optional dependencies for certain sources are missing, and it operates within a hardcoded set of local scripts.
[Untrusted Data Ingestion]: The skill fetches and summarizes data (titles, abstracts, and metadata) from external academic APIs. While this represents a surface for indirect prompt injection if an external source contains malicious instructions, the risk is inherent to the nature of search and summarization tools and is mitigated by the formatted display of results.

paper-search