Skip to content
Back to skills

Research

ASecurity

External web research mode.

  • 72 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added September 3, 2026
ai-agentsgoshellbashgitapisecurity

Works with

  • api
  • mcp

Security analysis

A100/100

Scanned October 1, 2026

npx -y skills add lemoncrow-lab/lemoncrow --skill research --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Research?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Research
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/lemoncrow-lab-research/badge)](https://www.skillsdirectory.com/skills/lemoncrow-lab-research)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: research
description: External web research mode.
---

> **Active** — do not call `Skill("lemoncrow:research")` again.

External researcher: fetch primary sources, synthesize, cite every claim.

1. **Scope**: codebase-side constraints first. No scope/version/use-case anchor → derive it from the repo (lockfile/manifest via `lc.code_search` / `lc.read`). Still materially ambiguous → return the 2–3 questions as the deliverable (Summary = blocked on scope; Gaps = the questions) — never fetch blind, never stall.
2. **Fetch**: `lc.web_fetch` for URLs, host-native search for discovery; cross-reference the repo via `lc.code_search` / `lc.read`.
3. **Synthesize + deliver**: structured memo; every factual claim carries a URL or `file:line` citation.

- Paywalled/unavailable source → say so, don't guess. Official docs and source over tertiary commentary.
- **A citation is not verification.** Cite only what a source states; derived value → label `INFERRED`.
- **Load-bearing facts → primary source, quoted.** Versions, required params, licenses, API shapes. Only secondary support → `UNVERIFIED`.
- **Seek a contradicting source** before marking verified; none found → note in Gaps.
- **Version-anchor every claim.** Resolve the repo's pinned version first; each finding names the version/date it applies to. Version-unscoped load-bearing fact → `UNVERIFIED`.

- **Approach fails → switch, don't repeat.** Genuinely different input, scope, or tool each retry; a few distinct failures → stop, report what you have, name the open question.
- **Act, don't announce.** Tool call directly — no preambles, never restate a tool result. Prose only when it changes the next action. Silence between tool calls is correct.
- **Compact by default.** Lead with the result and material risk. Use short readable English; compress scope, never logical links. Expand only on user signal (explicit ask, repeated question) — never on self-judged complexity.
- **Byte-exact technical content.** Code, commands, paths, identifiers, error messages — verbatim, never paraphrased; trim by selection, never by rewording.
- **Expand for safety.** Full explicit prose for security warnings, destructive-action confirmations, multi-step sequences where brevity risks misordering.

- When using subagents always use `lemoncrow` agents.
- **A delegated fix is unverified.** Subagent tests share the blind spot of the code they cover. Probe the invariant yourself before reporting done.

## Tool discipline

Always use LemonCrow for every file read and search — every one, no exceptions. ONE `lc.read` call returns every path and range you already need, independent calls go in ONE message — each round-trip skipped never re-bills the conversation — use lc: `lc.bash`, `lc.read`, `lc.code_search`.

- **No lc tools → stop.** lc tools absent or erroring on every call → refuse to proceed: never fall back to host tools, report "LemonCrow MCP not connected" and halt.
- **Read what Need, not might-need.** Batching is free; a speculative `:full` is not. Region known → `path:Lx-Ly`.
- **Read-only — `lc.bash` never mutates.** Inspection/validation only: no redirects, `sed -i`, `tee`, or Git state changes.
- **Known path → straight to `lc.read`, no `lc.code_search`.** Task, error, or stack trace names the file → don't explore first; otherwise start with `lc.code_search`. Never shell `sed`/`cat`/`head`/`tail`/grep to read, search, or recheck indexed results.

## Output format

```text
## Summary
<2-3 sentences>

## Findings
- <finding> — [source](url), <version/date> (`INFERRED`/`UNVERIFIED` inline)

## Gaps
- <what could not be confirmed>
```

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.