Agent skill · Audited from source

Source Ingest

skill · WILLOSCAR/research-units-pipeline-skillsLicence not declaredAudited 14 Oct 2026 · source 81994516a430

★ 514pushed 9 days ago

✓SAFEGrade B · 89/100 · 14 Oct 2026 · 8199451

514repo stars · whole WILLOSCAR/research-units-pipeline-skills

Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 81994516a430 and observed filesystem and network access and no hard-coded secrets. What it does: Fetch and normalize supported source-tutorial inputs into local, traceable text artifacts.

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Source Ingest (WILLOSCAR/research-units-pipeline-skills)”. Retrieved 14 Oct 2026. https://modelsatlas.com/skills/willoscar/source-ingest

Trust audit

Audit 0.4.1 · source read 14 Oct 2026

Trust score89/100✓SAFE B

0 critical0 high1 medium1 low0 info

SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 16,667 of 17,602 audited skills.

What the source does

FilesystemDeclared1 observation
NetworkDeclared5 observations
ShellNone observedNo commands run in the source
DependenciesPinnedNothing floats
SecretsNone foundNo keys in source

Five audit layers

Layer	What we check	Result	Findings
`L0` Provenance	Repo owner, licence, archive status, activity	WARN	2
`L1` Static source	Secrets, path traversal, supply chain, hidden code	PASS	0
`L2` Instructions	Prompt injection, authority framing, hidden directives	PASS	0
`L3` Inventory	The files and declarations match the source	PASS	0
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED why	0

Gates applied: no behavioural pass, no license.

Findings (2)

MEDIUMInventory / provenanceinv.symlink · .claude/skills

F-13 Inventory / provenanceCWE-1104Layer L0

.claude/skills

Why: link not followed
Fix: —

LOWInventory / provenanceinv.no_license

F-13 Inventory / provenanceCWE-1104Layer L0

Why: no LICENSE file and no repo licence
Fix: add a licence

Audit 0.4.1 · source sha 81994516a430 · 14 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

PublisherWILLOSCAR GitHub userOwner of the repository this skill is read from
Source folderWILLOSCAR/research-units-pipeline-skills/.codex/skills/source-ingestThe exact folder we audited
LicenceNot declaredAs the repository states it
Commit pinned for this verdict81994516a430A new audit runs when the source changes
Repository statusNot archivedLast push 9 days ago
Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Fetch and normalize supported source-tutorial inputs into local, traceable text artifacts.

---
name: source-ingest
description: "Fetch and normalize supported source-tutorial inputs into local, traceable text artifacts."
---

# Source Ingest

## Triggers & routing

- **Trigger**: source ingest, ingest sources, normalize tutorial sources, 网页抽取, 资料归一化.
- **Use when**: `source-tutorial` 的 C1,需要把 `sources/manifest.yml` 中的网页/PDF/repo/docs 变成可追溯文本。
- **Skip if**: source manifest 还没定,或来源尚未确认。
- **Network**: required for remote URLs.
- **Guardrail**: 只把成功抽取的内容当作有效 source;失败来源必须落盘记录,不能默默忽略。


Goal: normalize mixed source inputs into local tutorial-ready text while preserving provenance.

## Inputs

- `sources/manifest.yml`

## Outputs

- `sources/index.jsonl`
- `sources/provenance.jsonl`

## Supported kinds

- `webpage`
- `pdf`
- `markdown`
- `repo`
- `docs_site`
- `video`

## Behavior

- Accept local file paths or remote URLs from `sources/manifest.yml`.
- For `video`, use transcript-first ingestion:
  - provided `transcript_locator`
  - Bilibili subtitles when available
  - otherwise fail clearly instead of pretending the watch page is usable text
- Plain YouTube/Bilibili watch pages should not be modeled as `kind: webpage`.
- Continue past optional-source failures and record warnings.
- Fail closed when any source marked `required: true` cannot be ingested.

## Script

### Quick Start

- `uv run python .codex/skills/source-ingest/scripts/run.py --workspace <workspace>`

### All Options

- `--workspace <dir>` (required)
- `--unit-id <U###>`
- `--inputs <semicolon-separated>`
- `--outputs <semicolon-separated>`
- `--checkpoint <C#>`

### Examples

- Ingest all listed sources:
  - `uv run python .codex/skills/source-ingest/scripts/run.py --workspace <workspace>`

## Troubleshooting

### Issue: repo or docs site ingests too much noise

**Fix**:
- Narrow the manifest to the most relevant docs root or replace the source with a specific docs page.

Excerpt, first 1,877 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 8199451

Download folder ↗

git clone https://github.com/WILLOSCAR/research-units-pipeline-skills
git -C research-units-pipeline-skills checkout 81994516a430

The author documents no install command, so this uses the repository directly. Our verdict covers commit 81994516a430 only.

Works in which agents?

What its own text says, not a test

“Mentioned” means the skill’s text names the agent. We have not run it there.
Agent	Status	More
Codex	Mentioned in its text, not tested	Skills for Codex · About Codex

Audit history

Every audit, every source change

2026-10-14
✓SAFE B 89 / 100
first audit · source 81994516a430

README badge

For maintainers · shows the latest audit

[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/willoscar/source-ingest/badge.svg)](https://modelsatlas.com/skills/willoscar/source-ingest/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.