The Agent Skills Directory

[DATA_EXPOSURE]: The script scripts/gemini_research.py performs network requests to generativelanguage.googleapis.com. This is used to fetch biography and bibliographic data for the 'Author Discovery' and 'Book Discovery' features. Because this targets a well-known service (Google) for its primary intended purpose, it is considered safe.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted markdown data from the user's vault to generate statistics and Maps of Content (MOCs).
Ingestion points: All scripts in the scripts/ directory read markdown files from the user-provided vault path.
Boundary markers: No specific boundary markers or 'ignore' instructions are present in the scripts when parsing note content.
Capability inventory: The skill possesses file-read and file-write capabilities (creating MOCs, reports, and backups) and network access via the Gemini API.
Sanitization: Note content is processed using regular expressions and string analysis; no content is passed to sensitive sinks like eval() or exec().
[EXTERNAL_DOWNLOADS]: scripts/gemini_research.py utilizes the standard Python requests library to communicate with official Google API endpoints. No untrusted third-party code is downloaded or executed.

pkm-vault-master