tiangong-kb-textbook-search

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly accepts explicit JSON fields like api_key and textbook_api_key which are "passed as CLI flags" (taking precedence over env vars), meaning an agent could be required to include secret values verbatim in generated commands/CLI invocations.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/textbook_search.sh, the required runtime reads user-supplied JSON fields (query/input or request_file/input_file) and forwards them into the Tiangong CLI education search --sources textbook --json request, so outsider-authored free text is ingested.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill defaults to executing remote code at runtime via the npm package invocation "npx @tiangong-ai/cli@latest", which will fetch and run code from the npm registry and is required for the skill to operate.