tiangong-kb-textbook-search

This Bash fragment does not show direct malware behavior (no obvious exfiltration, backdoor, or command-and-control code in the wrapper itself). However, it has notable supply-chain and execution-control risks: it defaults to executing an unpinned dependency via npx @tiangong-ai/cli@latest, and it allows the executed CLI executable to be overridden through TIANGONG_AI_CLI/TIANGONG_AI_CLI_BIN environment variables. Additionally, it can load and export configuration/secrets from env files whose paths are influenced by JSON input or request/input locations, which increases the impact of attacker-controlled inputs. Overall security posture is driven by these design choices rather than explicit malicious operations in the shown code.

SUSPICIOUS: the skill’s search behavior is coherent with its stated Tiangong textbook-search purpose, but it depends on a mutable external CLI install (`npx ...@latest`) and forwards credentials to that package. The main concerns are supply-chain trust, credential forwarding, and endpoint override flexibility rather than clear malicious behavior.