The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx @tiangong-ai/cli@0.0.19 to fetch and execute the Tiangong AI CLI tool. This is a vendor-owned package hosted on the official registry and is required for the skill's primary function.
[COMMAND_EXECUTION]: The wrapper script scripts/esg_search.sh executes shell commands to interact with the CLI tool. It includes configuration options to override the CLI entry point via environment variables, which is a standard developer feature.
[CREDENTIALS_SAFE]: Authentication is handled through specific environment variables (TIANGONG_ESG_APIKEY, TIANGONG_AI_APIKEY). The skill supports loading these from .env files located in the input file's directory, adhering to standard secret management practices.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Processes user-supplied search queries and external JSON payload files (request_file, input_file) in scripts/esg_search.sh.
Boundary markers: Uses jq to parse and structure inputs before passing them to the CLI.
Capability inventory: Executes shell commands and has the ability to write search results to an output file path provided by the user.
Sanitization: Implements strict schema validation using jq filters to ensure ESG metadata filters are string arrays and date ranges are numeric, reducing the risk of malformed data injection.

tiangong-kb-esg-search