โน
Purpose & Capability
The stated purpose (Russian medical-device market research, multilingual web search, IDF data, government/tender monitoring, Word output) matches the included code and instructions: SKILL.md, PORTING_NOTES, data_sources.json and scripts implement web search and Word export. However the registry metadata lists no required env vars/credentials while the documentation and data template clearly require a SerpAPI key (and optionally TGStat). That omission is an incoherence between manifest and actual requirements.
โ
Instruction Scope
Runtime instructions focus on web search (SerpAPI/Yandex/Google), scraping/collection of public sources (IDF, minzdrav, kremlin, zakupki, ecommerce sites) and producing a Word report. The scope stays within market-research tasks; I see no instructions that ask the agent to read unrelated local files or exfiltrate unknown secrets. The tool list (WebFetch, WebSearch, ExecuteCommand, Read/Write) is broad but consistent with a skill that fetches pages and runs local Python to generate DOCX.
โ
Install Mechanism
No install spec is provided (instruction-only for the agent) and included Python scripts use common pip packages (python-docx, requests, bs4, etc.). No downloads from arbitrary URLs or archive extraction are present. The risk surface is typical for a code snippet that runs locally.
โ
Credentials
The skill requires API keys (SerpAPI mandatory, TGStat optional) according to SKILL.md and PORTING_NOTES and data_sources.json; yet the registry metadata lists no required environment variables or primary credential. The skill also instructs users to edit data/data_sources.json to store keys (a file in the skill directory) rather than documenting a secure environment-variable approach. This mismatch and the practice of storing secrets in a repository file are disproportionate and risky โ the manifest should declare the required credentials and the skill should document secure handling (env vars or secure vault).
โ
Persistence & Privilege
always:false (default) and model invocation not disabled โ normal for a user-invocable skill. The skill does not request special persistent privileges or modify other skills. One operational note: run_report.py attempts to import modules from a sibling 'report-gama' directory if present, meaning it can execute code from another skill directory at runtime; this is an intended integration but increases the surface to review that other skill if present.