Add company-research skill — deep ICP research with HTML report

[jay-sahnan]

Summary

• New company-research skill for discovering + deep-researching target companies using Browserbase Search API and a Plan→Research→Synthesize pattern
• Scores ICP fit (1-10) and outputs a self-contained HTML report (auto-opens in browser) plus CSV spreadsheet — written to ~/Desktop/{company}_research_{YYYY-MM-DD}/
• Scope is research-only: no contact discovery or email generation (for the full SDR pipeline with emails, see Add cold-outbound skill — SDR lead gen with Browserbase search and deep research #68 / cold-outbound)

---

Note

Medium Risk
Adds a new end-to-end research workflow plus Node.js scripts that read/write user-controlled files and invoke external bb CLI/browser commands, so failures or environment differences (CLI availability, parsing edge cases) could impact output generation but existing functionality is largely unaffected.

Overview
Adds a new company-research skill with a documented Plan→Research→Synthesize workflow for discovering targets via bb search, researching/scoring ICP fit, and writing one markdown file per company.

Introduces supporting scripts: extract_page.mjs (structured page extraction with bb fetch and bb browse fallback), list_urls.mjs (dedupe discovery batches by domain), and compile_report.mjs (parse YAML frontmatter from research markdown, dedupe by normalized name, generate index.html, per-company HTML pages, and results.csv, with optional --open).

Updates ignore rules to exclude per-skill local Claude settings and ignore profiles/*.json while keeping an example profile in-repo.

^{Reviewed by Cursor Bugbot for commit a342256. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a342256. Configure here.}

[cursor]

Regex injection via unescaped prefix in RegExp constructor

Low Severity

The prefix variable is interpolated directly into new RegExp(...) without escaping regex special characters. If the prefix contains characters like ., (, [, *, or +, the regex could either throw a syntax error or match unintended filenames. The default value "company" is safe, but the --prefix flag accepts arbitrary user input.

 

^{Reviewed by Cursor Bugbot for commit a342256. Configure here.}

[cursor]

Redundant dynamic import of already-imported fs module

Low Severity

mkdirSync is obtained via await import('fs') at the top level, but fs is already statically imported on line 10. Adding mkdirSync to the existing static import is simpler and avoids an unnecessary top-level await that changes the module's evaluation semantics for no benefit.

 

^{Reviewed by Cursor Bugbot for commit a342256. Configure here.}