tiangong-auto-research-workbuddy
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/workbuddy_research_cli.shdynamically searches for a valid Node.js 24 executable across multiple system and user-level paths (including NVM, FNM, and Volta directories). It then uses the located binary to execute a JavaScript file (research_cli.mjs) residing in a sibling project directory (../../tiangong-auto-research/). This is a legitimate integration pattern for an adapter skill. - [COMMAND_EXECUTION]: The skill invokes local command-line operations via a shell script to manage the research workflow. The script includes safety checks, such as verifying that the target resolver is a regular file (not a symbolic link) and ensuring the runtime environment meets version requirements before execution.
Audit Metadata