tiangong-kb-edu-search

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly says explicit JSON fields like api_key and edu_api_key are passed as CLI flags and take precedence, which means the agent may need to emit those secret values verbatim in generated commands.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL runtime wrapper reads outsider-authored free text as the user-provided query/input (JSON field) and forwards it to npx @tiangong-ai/cli@latest education search --query with --sources edu, meaning an outsider can supply arbitrary text that the underlying search/LLM ingests.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runs "npx @tiangong-ai/cli@latest" at runtime (seen in scripts/edu_search.sh and SKILL.md), which causes remote code to be fetched and executed via npx and is relied on as the default CLI, so it is a runtime external dependency that executes remote code.