lifecyclemodel-resulting-process-builder
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
pnpm dlxto download and execute the@tiangong-lca/clipackage from the npm registry. This is a vendor-owned resource required for the skill's core functionality. - [COMMAND_EXECUTION]: The Node.js wrapper script
scripts/run-lifecyclemodel-resulting-process-builder.mjsexecutes shell commands by delegating to thetiangong-lcaCLI tool for building and publishing resulting processes. - [INDIRECT_PROMPT_INJECTION]: The skill ingests lifecycle model data and process datasets in JSON format. This represents a potential vulnerability surface where maliciously crafted data could be introduced.
- Ingestion points:
source_modelandprocess_sourcesJSON inputs. - Boundary markers: Absent in the wrapper script.
- Capability inventory: Shell command execution via the CLI wrapper and local file system writes.
- Sanitization: Absent in the wrapper script.
Audit Metadata