The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/textbook_search.sh executes the Tiangong AI CLI using the npx utility or a binary specified in environment variables (TIANGONG_AI_CLI, TIANGONG_AI_CLI_BIN). While it uses shell array expansion to safely handle arguments, the execution of external binaries is a core capability.
[EXTERNAL_DOWNLOADS]: The skill defaults to using npx @tiangong-ai/cli@latest, which downloads the latest version of the vendor's CLI tool from the NPM registry at runtime. As this resource belongs to the skill's authoring organization, it is considered a vendor-owned resource.
[CREDENTIALS_UNSAFE]: Sensitive information, including api_key and textbook_api_key, is passed to the CLI tool as command-line flags (e.g., --api-key "$value"). On many multi-user systems, command-line arguments are visible to other users through process monitoring tools like ps or top.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it retrieves content from external textbook sources and presents it to the agent without explicit isolation.
Ingestion points: The query and input fields in the JSON payload, as well as the retrieved textbook content from the CLI output.
Boundary markers: None. The script does not wrap the output in delimiters or provide instructions to ignore embedded commands.
Capability inventory: The script has the ability to execute shell commands and read local .env files.
Sanitization: The script uses jq to parse and validate the JSON input and employs shell array quoting to prevent direct command injection into the wrapper script itself.

tiangong-kb-textbook-search