The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill attempts to download the @tiangong-ai/cli package from the npm registry at runtime using npx if a local version is not specified. This is a standard vendor-provided dependency for the skill's search functionality.
[REMOTE_CODE_EXECUTION]: The report_search.sh wrapper script contains logic to override the primary CLI command using environment variables such as TIANGONG_AI_CLI. These variables can be populated from external .env files found in paths provided via the env_file or request_file input parameters. While the script prevents overwriting existing environment variables, the ability to load new variables from arbitrary file paths enables a form of dynamic execution.
[COMMAND_EXECUTION]: The skill executes shell commands to invoke the research CLI and relies on the jq utility to parse and transform JSON inputs.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it processes external file paths provided in tool arguments. These paths are used to load data or configuration into the execution context without explicit boundary markers or sanitization of the file's source.

tiangong-kb-report-search