The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill performs runtime installation of Python libraries pypdf and python-docx via pip install to handle local file formats, as documented in the research flow instructions.
[EXTERNAL_DOWNLOADS]: The update.md command utility triggers a git pull from the remote repository https://github.com/hoolulu/deep-research to update the skill's source code without manual verification.
[COMMAND_EXECUTION]: The skill makes extensive use of system shell commands (bash, rm, git, pip, python) for environment setup, file operations, and execution of internal utility scripts across the lifecycle of report generation.
[DYNAMIC_EXECUTION]: The script tools/dr_tools.py utilizes __import__ for dynamic module loading of internal components like dr_check, which can be an obfuscation or evasion technique if misused.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the web using search engines and scrapers (Scrapling). This content is then processed by LLM agents to generate reports, creating a potential attack surface for indirect prompt injection if malicious instructions are embedded in the scraped data. The skill lacks explicit sanitization or high-robustness boundary markers for this external content.
[CREDENTIALS_UNSAFE]: The tools/generate_pages.py script accesses the GITHUB_TOKEN environment variable to authenticate requests to the GitHub API, handling sensitive credentials within the skill's execution environment.

deep-research