The Agent Skills Directory

[COMMAND_EXECUTION]: The agent invokes a local Python helper script (scripts/research_run.py) to execute research workflows in the background, which is an intended architectural design for long-running tasks.
[EXTERNAL_DOWNLOADS]: The skill communicates with the vendor's API at https://cuecue.cn/api to submit research mandates and retrieve generated reports.
[DATA_EXFILTRATION]: The skill provides functionality to upload local documents to the vendor's infrastructure for grounded research. This transmission of data to the vendor's service is an intended feature that is clearly documented and requires explicit user confirmation.
[SAFE]: Sensitive API keys are managed using standard environment variables or local configuration files, avoiding unsafe hardcoding of credentials.
[SAFE]: Heuristic flags identifying hex-encoded strings and dynamic imports in the test suite were reviewed and found to be benign; they are used for error handling validation and structural verification within the testing environment.
[SAFE]: While the skill ingests external research data which presents a standard surface for indirect prompt injection, it handles this content as data for report generation rather than executable instructions, and the ingestion originates from the vendor's controlled API.

cue-research