tiangong-kb-course-search
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads the
@tiangong-ai/clipackage from the npm registry usingnpx. This is a standard procedure for using the vendor's official command-line tools. - [REMOTE_CODE_EXECUTION]: Executes the downloaded npm package at runtime to process search queries. This behavior is confined to the official vendor tool.
- [COMMAND_EXECUTION]: Runs shell commands to invoke the search CLI via the
course_search.shscript. The script allows overriding the CLI entrypoint through environment variables likeTIANGONG_AI_CLIfor developer flexibility. - [DATA_EXFILTRATION]: Accesses
.envfiles located in the directory of provided input files to load configuration and credentials, such as bearer tokens required for the search API.
Audit Metadata