The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads and executes the @tiangong-lca/cli package from the NPM registry using pnpm dlx. This is the core mechanism for performing searches and is controlled by the vendor.
[COMMAND_EXECUTION]: The cli-launcher.mjs script utilizes node:child_process.spawnSync to run shell commands, including pnpm for version checks and package execution, and node for internal scripts.
[DYNAMIC_EXECUTION]: The script implements a build-on-demand system for local CLI installations. If a local directory is specified, it may trigger pnpm install and pnpm run build to ensure the local binary is up-to-date before execution.
[REMOTE_CODE_EXECUTION]: The skill uses pnpm dlx to fetch and execute the @tiangong-lca/cli package from the NPM registry. While this is a vendor-owned resource, it involves fetching code from a remote repository at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill processes search queries and classification filters provided via JSON files or command-line arguments. This represents a surface for indirect prompt injection where malicious input could attempt to influence the search parameters or output.
Ingestion points: assets/example-request.json and user-provided files via the --input argument.
Boundary markers: Absent; the query text is passed directly to the search command without explicit delimiters or instructions to ignore embedded commands.
Capability inventory: Command execution through spawnSync and network interaction via the CLI tool targeting a Supabase edge function.
Sanitization: Absent; the skill does not validate or sanitize the contents of the search query or filter objects before passing them to the CLI.

lifecyclemodel-hybrid-search