tiangong-kb-patent-search

SUSPICIOUS: the skill’s purpose and core capability align, but it relies on an unpinned `npx @latest` CLI whose official provenance was not verified in the provided evidence, and it forwards credentials plus allows API endpoint override. This looks more like medium supply-chain and credential-routing risk than confirmed malicious behavior.