The Agent Skills Directory

[SAFE]: The skill is a legitimate implementation of a research assistant interface for Google's Gemini Deep Research API. No malicious patterns, obfuscation, or unauthorized access behaviors were detected during the analysis.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill communicates exclusively with official Google Gemini API endpoints (generativelanguage.googleapis.com) to perform its primary function. It correctly handles sensitive credentials by instructing users to use environment variables or .env files, avoiding hardcoded secrets in the source code.
[PERSISTENCE]: The skill maintains a local research history in ~/.cache/deep-research/history.json. This is a standard practice for CLI tools to allow users to reference previous tasks and does not involve malicious persistence mechanisms like modifying shell configuration files or system services.
[INDIRECT_PROMPT_INJECTION]: The skill interpolates user-supplied queries into prompts sent to the external research agent. While this represents a data ingestion surface, the impact is minimal as the skill's capabilities are restricted to network communication with a trusted provider and local file writes to its own cache directory. The underlying Google Gemini service also employs its own safety guardrails.

deep-research