tiangong-kb-sci-search

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill invokes npx to fetch and run the remote package "npx @tiangong-ai/cli@latest" at runtime, which downloads and executes external code that the skill depends on (remote CLI) and therefore poses a runtime execution/control risk.