tiangong-wiki-skill

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The repository contains intentional automation features that can exfiltrate vault content to external LLM/parser endpoints and perform remote installs / run unconfined agent workflows (npx skill installs, automatic pip/npm installs, and a default "danger-full-access" agent sandbox), creating high-risk supply-chain, data-exfiltration, and remote-exec abuse vectors.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The Codex/Claude Code “Wiki Skill” workflow ingests outsider-authored free text from the user-controlled vault: it reads each queued vault item (including extracting full text to .queue-artifacts/<file-artifact>/extracted-fulltext.txt / using response.txt) and then passes that plain text to the agent for page creation/proposal.