flow-hybrid-search
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes external commands via
node:child_process.spawnSync. It specifically runspnpm dlxto invoke thetiangong-lcaCLI andnodeto run local wrapper scripts. - [EXTERNAL_DOWNLOADS]: The skill instructions and scripts (
scripts/lib/cli-launcher.mjs) usepnpm dlxto download and execute the@tiangong-lca/cli@0.1.16package from the npm registry. This is a vendor-owned package corresponding to the skill author. - [DYNAMIC_EXECUTION]: The skill provides an opt-in mechanism to use a local CLI build via the
--cli-dirargument. To mitigate risks associated with executing local code, thecli-launcher.mjslibrary performs extensive validation, verifying the package name, version, node engine requirements, and SHA-256 hashes of internal schema files against hardcoded values.
Audit Metadata