tiangong-kb-esg-search

SUSPICIOUS. The stated purpose is coherent with ESG search, but the execution model is broader than needed: it runs a mutable remote CLI via `npx`, forwards API keys into that CLI, implicitly loads `.env`, and permits endpoint/binary overrides that can reroute data or execution. This is more a trust and data-flow integrity problem than confirmed malware.