company-research-intelligence-agent
v1.0.0Deep-dive company research in seconds. Get comprehensive profiles with firmographics, technographics, funding history, executive team, competitors, workforce...
⭐ 2· 370·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name/description and the included CLI/code all point to using Explorium's AgentSource API (BASE_URL: https://api.explorium.ai/v1) to perform company research — this is coherent. However the registry metadata claims no required env vars while SKILL.md and bin/agentsource.py clearly expect an EXPLORIUM_API_KEY (or a saved config.json). That mismatch is unexplained and should be corrected/clarified.
Instruction Scope
Runtime instructions ask the agent to locate and run a local CLI, write/read temp files in /tmp, and (optionally) include the user's query text as --call-reasoning which will be sent to the remote API. The SKILL.md explicitly warns not to paste API keys in chat and to only send call-reasoning with user consent, which is good. Slight concern: the CLI discovery globs search broad filesystem paths (e.g., sessions/*/mnt/**/*agentsource*/bin/agentsource.py) which could traverse mounted/session directories; this is intended for discovery but increases the breadth of local file accesses.
Install Mechanism
There is no network installer; setup.sh copies the included bin/agentsource.py into ~/.agentsource/bin and optionally writes ~/.agentsource/config.json. No remote downloads occur during setup. This is lower risk than fetching arbitrary code from the network, but you should still inspect the provided scripts before running them.
Credentials
The skill requires an Explorium API key to function (EXPLORIUM_API_KEY or saved config.json). That is proportionate to the stated purpose. The concern is the registry metadata does not declare this required env var, which is misleading. Also note the setup can persist the API key to ~/.agentsource/config.json; if you care about key storage, you should choose not to save it or manage it via environment variables.
Persistence & Privilege
The skill is not force-enabled (always:false). Installing the setup script creates ~/.agentsource and a CLI under that directory and writes temp outputs to /tmp — expected for a CLI wrapper. The skill can be invoked autonomously by the agent (platform default); combine that with network access to the API if you require stricter controls, but on its own this is normal for a service-integration skill.
What to consider before installing
Before installing: 1) Confirm you trust the skill source — the package claims Explorium affiliation but notes it is unofficial. 2) Inspect bin/agentsource.py and setup.sh (they are included) and verify the API base URL (https://api.explorium.ai/v1) is the expected endpoint. 3) Be aware the skill requires an EXPLORIUM_API_KEY even though the registry metadata omitted that; prefer setting the key as an environment variable rather than saving it to ~/.agentsource/config.json unless you trust the machine. 4) If you do not want the agent to send user queries to the remote API, avoid passing --call-reasoning (the CLI will only send call_reasoning if provided). 5) If you need higher assurance, ask the publisher to correct the registry metadata to list EXPLORIUM_API_KEY and provide a verifiable homepage/source. Installing is reasonable if you trust Explorium and this package, but treat the metadata mismatch as a red flag and review the files locally before running setup.sh.Like a lobster shell, security has layers — review code before you run it.
latestvk97cmacek7ebcr0dcr2ejdjch9821m27
License
MIT-0
Free to use, modify, and redistribute. No attribution required.