tiangong-kb-esg-search

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly accepts and forwards api_key / esg_api_key values (including via JSON input or request_file) and notes precedence over environment credentials, which can require the LLM to include secret API keys verbatim in requests/command payloads (dry_run only masks them), creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow ingests outsider-authored free text via the user-provided query/input (or the user-provided JSON request_file forwarded as --input) in scripts/esg_search.sh, which is then sent to the research search --sources esg endpoint through the Tiangong CLI.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill defaults to running the remote npm package "npx @tiangong-ai/cli@0.0.19" at runtime (see CLI_COMMAND), which causes npx to fetch and execute remote code, making it a required external runtime dependency.