The Agent Skills Directory

[SAFE]: The skill follows security best practices for credential management, using environment variables to load API keys rather than hardcoding them. It also includes logic to handle common key formatting errors gracefully.
[SAFE]: Secure file handling is implemented in src/free_search/storage.py. The skill validates that storage operations are confined to the workspace's memory directory unless explicitly overridden by a specific environment variable.
[SAFE]: Denial-of-service protection is included in src/free_search/providers.py, where a _guard_response_size function checks the content length and body size of upstream responses to prevent memory exhaustion.
[SAFE]: Input sanitization is used in src/free_search/storage.py to slugify search queries before they are used to generate filenames for reports and cache, preventing path traversal attacks.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of retrieving and processing untrusted web content.
Ingestion points: Data enters the system through 12 different search providers in src/free_search/providers.py (e.g., Brave, Tavily, DuckDuckGo).
Boundary markers: The skill does not currently implement specific delimiters or 'ignore' instructions for the search results before they are passed to the agent.
Capability inventory: The skill possesses network access (requests) and file-writing capabilities to the local workspace.
Sanitization: Basic sanitization is performed by stripping HTML tags from snippets for certain providers like Bing and Wikipedia using BeautifulSoup.

free-search-aggregator