strategic-analyst-skill

This skill largely does what it says: framework-driven, web-backed industry analysis with templates and quality checks. Before installing or using it: - Verify and update manifest: ask the publisher/registry to declare the Tavily credential (TAVILY_API_KEY) in the skill metadata so automated audits and admins can see the required secret. - Inspect bundled code: review tools/data_collector.py, tools/report_generator.py, and tools/quality_gate.py for any network endpoints, telemetry, or unexpected outbound connections before running them. - Confirm where data_collection.md is saved and who can access it. The skill forces saving raw search queries, source URLs and snippets — ensure these logs are stored only in a trusted workspace and are not uploaded to external services. - Be cautious with sensitive inputs: avoid running the skill against private/internal URLs or pasting confidential business data until you confirm storage and access controls. - Test with non-sensitive queries first to observe what external tools are invoked (agent-browser, WebFetch, summarize, tavily) and whether any unexpected external hosts are contacted (inspect network logs). - If you must provide a Tavily API key, scope it to least privilege and monitor its usage. If possible, prefer a dedicated key instead of a high-privilege account key. If these points are acceptable and the code review shows no hidden endpoints, the skill can be used for its intended purpose. If the publisher cannot or will not update the manifest to declare the Tavily requirement, consider that a red flag and avoid providing credentials.