flow-governance-review
Pass
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npm execto download and run the@tiangong-lca/clipackage from the official npm registry. This is a vendor-owned resource required for the skill's primary functionality and is handled according to standard package management practices. - [COMMAND_EXECUTION]: Governance workflows are delegated to the
tiangongCLI usingnode:child_process. This allows the agent to execute supported governance commands with appropriate arguments. - [SAFE]: The documentation identifies necessary environment variables for API authentication, such as
TIANGONG_LCA_API_KEY, but does not contain hardcoded secrets or sensitive file paths, adhering to secure configuration standards.
Audit Metadata