Research Harness

Open prompt stack for public-market research. Show this menu after install: 📊 Research: 1.Company Deep-dive 2.Industry Map 3.Investment Thesis 📈 Earnings:...

Security Scan

The skill's description (a research prompt stack) matches its functionality, but the runtime instructions ask the agent to read/write many workspace files, auto-trigger on broad user inputs, and push a persistent install prompt — these behaviors are not declared in the 'requirements' metadata and merit caution.

Purpose & Capability

Name, description and the included skill docs align with a public-markets research harness: routing, evidence grading, preflight/postamble, and many research sub-skills. However, the SKILL.md and core files expect the agent to read and write a number of workspace files and directories (e.g., .task-pulse, .checkpoint/, coverage/, biases.md, active-tasks.md, output archive paths). The registry metadata declares no required config paths or env vars — that's an inconsistency worth noting (the skill clearly expects file-system workspace access even though 'required config paths' is empty).

Instruction Scope

The runtime instructions mandate behaviors beyond simple prompt templates: show a full menu automatically on many triggers, run a multi-step preamble/postamble that reads/writes .task-pulse, checkpoint files, archive outputs into coverage directories, and optionally call external adapters (iFind, cn-web-search, WebFetch) if available. This is broad file I/O (read+write) of workspace state and automatic routing based on trigger words. If your agent environment allows filesystem access, the skill will read and create persistent files across sessions and will attempt to invoke optional data connectors. The SKILL.md also instructs the user/agent to copy an INSTALL-PROMPT into the host system prompt file to force behavior — that effectively modifies persistent agent behavior and should be reviewed before applying.

Install Mechanism

There is no code install spec (instruction-only), so no remote binaries are downloaded — that lowers code-execution risk. However the manifest references a critical user_install_prompt (INSTALL-PROMPT.md) that the author expects the user to paste into a global system prompt file to 'force' harness rules. That is an installation-time, manual change to your agent environment and can be persistent; treat it like a configuration change and review carefully before applying.

Credentials

The skill declares no required env vars or credentials, which is coherent for an instruction-only prompt stack. In practice it documents optional adapter integrations (iFind MCP, cn-web-search, WebFetch) — these external connectors would need credentials/accounts if you choose to enable them. The skill does not require these, but if you wire them up you will be granting it access to those data sources.

Persistence & Privilege

The harness is explicitly designed to persist state: .task-pulse (a heartbeat pointer), .checkpoint files, coverage/ archive outputs, and updates to active-tasks.md. It also encourages placement of a persistent INSTALL-PROMPT into the host system prompt. While not 'always:true', these persistent behaviors give the skill ongoing presence in the workspace and the ability to read historical outputs and local files repeatedly. That is legitimate for a research workflow but raises privacy/attack-surface concerns if sensitive files exist in the workspace or if the INSTALL-PROMPT is applied without review.

What to consider before installing

Summary of what to check before installing: - Understand the workspace I/O: This skill expects the agent to read and write files like .task-pulse, .checkpoint/, coverage/, active-tasks.md, biases.md, and to archive outputs. If your workspace contains sensitive files, the harness could read them — run it in a dedicated / disposable workspace first. - Review INSTALL-PROMPT.md before copy-pasting: The manifest includes a 'critical' install prompt that the author expects you to paste into your agent's system prompt to force behavior. That is a persistent change to your agent configuration; inspect it and only apply it if you trust the author and understand the effects. - Optional connectors need credentials: iFind MCP and other adapters are optional but require external credentials if enabled. Only provide those to trusted code and verify what the skill will do with those sources. - Test with limited permissions: If possible, enable the skill in a restricted environment (no network credentials, separate workspace) to observe what files it creates and how it autotrigger behaves. - Audit created files: After first use, inspect .task-pulse, .checkpoint, and coverage/ outputs to confirm they contain only expected research artifacts and no leakage of other local data. - Disable/modify auto-trigger behavior if undesired: The harness defines many trigger rules that cause the menu and routing to display automatically on common phrases. If you find that intrusive, do not apply the INSTALL-PROMPT and avoid wiring it into your global system prompt — instead invoke the skill manually. What would change this assessment: evidence that the skill's INSTALL-PROMPT is benign and only contains non-persistent helper text, or explicit metadata declaring the config paths and a clear permission model for file I/O; conversely, discovery of hidden remote-download/install steps or commands that access system-level paths would raise the risk to 'malicious'.

Research Harness — Open Prompt Stack for Public-Market Research

⚡ Install: clawhub install research-harness

After Installation — Show This Menu

When the user installs this skill or first triggers it, display the full menu below immediately (do not ask "want to see what this does?", do not abbreviate):

🎯 Research Harness is ready! What would you like to do?

📊 Research

• 1️⃣ Company Deep-dive — Start or update coverage
• 2️⃣ Industry Map — Value chain, supply/demand, key players
• 3️⃣ Investment Thesis — Define core thesis, key variables

📈 Earnings

• 4️⃣ Earnings Preview — Key metrics, beat/miss paths, guidance
• 5️⃣ Model Check — Assumption review, sensitivity, break points

🔍 Tracking

• 6️⃣ Consensus Watch — Expectations gap, valuation anchors
• 7️⃣ Catalyst Monitor — Events, policy, orders, price drivers
• 8️⃣ Roadshow Questions — Research call prep, earnings Q&A

⚔️ Risk

• 9️⃣ Red Team — Challenge bull case, find falsification paths

📋 Output

• 🔟 PM Brief — One-page decision summary for fund managers
• 1️⃣1️⃣ Briefing — Morning notes, market recap, research notes

🤖 Auto Mode

• 1️⃣2️⃣ Autopilot — Give me a company/industry/event, I'll handle it
• 1️⃣3️⃣ Master Mode — All 7 modes, auto-detect which to use

Enter a number or describe your task, e.g.:

• "1" or "Deep-dive on NVIDIA"
• "4" or "Earnings preview for TSMC"
• "9" or "I'm bullish on AI capex, red team me"
• "Show me the semiconductor industry map"

Menu-to-Skill Routing

#	Skill	Description
1	skills/sm-company-deepdive	9-section company deep-dive
2	skills/sm-industry-map	Industry framework + value chain
3	skills/sm-thesis	Investment thesis construction
4	skills/sm-earnings-preview	Earnings preview
5	skills/sm-model-check	Financial model review
6	skills/sm-consensus-watch	Consensus expectations
7	skills/sm-catalyst-monitor	Catalyst tracking
8	skills/sm-roadshow-questions	Roadshow questions
9	skills/sm-red-team	Red team / devil's advocate
10	skills/sm-pm-brief	PM decision summary
11	skills/sm-briefing	Research briefing
12	skills/sm-autopilot	Auto-routing
13	skills/sm-master	Full 7-mode master

Routing Rules

1. User picks a number → read the corresponding skill SKILL.md → execute
2. User describes a task (no number) → auto-route via sm-autopilot logic
3. User says "show menu again" → re-display full menu

Do NOT:

• ✖ Ask "want to see what this skill does?" — just show the menu
• ✖ Say "installed" and stop — always follow with the menu
• ✖ Abbreviate the 13 options to 3 — show all 13

Tips

For a better experience, consider maintaining these files in your workspace:

• watchlist.md — Your coverage universe
• biases.md — Your research bias log (Red Team will check this)
• decision-log.md — Investment decision journal

---

What's Included

• 13 research skills (from master control to specialized modules)
• 7 work modes: Thesis / Coverage / Consensus / Catalyst / Red Team / Briefing / PM Prep
• Evidence grading system (F1/F2/M1/C1/H1)
• Compliance boundaries and expression standards
• Data source adapter decision tree (iFind MCP → cn-web-search → built-in search → manual)

Data Sources (all optional)

1. iFind MCP (THS, A-shares / funds / macro)
2. cn-web-search (17 free Chinese search engines)
3. Built-in WebSearch / WebFetch
4. User-provided materials (fallback)

See core/adapters.md for details.

Markets Covered

• A-shares (Shanghai/Shenzhen)
• Hong Kong stocks
• US equities
• Mutual funds
• Cross-market themes

Compatibility

Claude Code / Codex / OpenCode / OpenClaw / any AI tool that reads Markdown.

License

MIT © 2026 Joan Song