curate-research
把一批 Harness Engineering 调研候选（文章/论文/工具的 URL）走完「抓取→翻译→评审→收录→清理」流水线，整合进本仓库 works/ 与 references/articles.md，并保持 C1–C13 一致性检查全绿。当用户说"处理这批调研候选 / 收录这些链接 / 整理 translate / 把这几篇翻译收进来"时使用。这是仓库给自己用的策展 harness。
68
84%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
在“①抓取”阶段，流程会对用户提供的每个 URL 使用 `baoyu-url-to-markdown`（并在论文/长文中额外抓取 HTML 全文到 `sources/<slug>/source-full.md`），随后在“③评审”中让评审 agent 读取这些 `sources/<slug>/source.md`/`source-full.md` 的外部正文内容，因此外部（外人作者）文本会被 LLM 在运行时直接摄入。
- Repository
- deusyu/harness-engineering
- Commit
858c0da
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.