tiangong-kb-course-search

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the wrapper/agent to pass bearer_token and api_key as CLI flags (e.g., --bearer-token) and to forward explicit secret fields, which requires embedding secrets verbatim into generated commands/requests and thus creates an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime path course_search.sh ingests outsider-authored free text from the caller-provided query/input JSON fields and forwards them directly to the npx @tiangong-ai/cli@0.0.19 education search --query/--input flow for course retrieval.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The wrapper and script default to invoking "npx @tiangong-ai/cli@0.0.19", which causes npx to fetch and execute remote package code at runtime (a required dependency), so this is a runtime external dependency that executes remote code.