tiangong-kb-patent-search

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly allows/encourages passing api_key / patent_api_key as explicit JSON fields that the wrapper forwards as CLI flags (i.e., embedding secrets in command-line arguments), which requires the LLM to include secret values verbatim in generated commands/requests.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime defaults to invoking remote code via "npx @tiangong-ai/cli@latest", which will fetch and execute external npm package code at runtime and is required for the skill to function.