tiangong-kb-sci-search
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/sci_search.shexecutes the@tiangong-ai/clitool vianpx. This is the primary intended functionality of the skill to interface with the vendor's research API. - [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch the latest version of the@tiangong-ai/clifrom the npm registry. This targets the official package of the vendor identified in the skill context. - [DATA_EXPOSURE]: The skill provides functionality to load authentication tokens and API keys from
.envfiles or environment variables. This follows standard security practices for secret management by keeping credentials out of the command-line arguments where possible, although it does allow passing them as JSON fields which are then converted to CLI flags. - [DYNAMIC_EXECUTION]: The wrapper script dynamically constructs CLI arguments based on JSON input. It uses
jqto safely parse and validate the input before execution, reducing the risk of shell injection.
Audit Metadata