flow-governance-review
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill implementation uses
npm execto fetch and execute the@tiangong-lca/clipackage from the public npm registry. This is the intended delivery mechanism for the vendor's command-line tools and originates from the author's own namespace. - [COMMAND_EXECUTION]: The script
scripts/run-flow-governance-review.mjsfacilitates the execution of varioustiangongCLI subcommands. These operations are strictly limited to the documented flow governance, remediation, and repair workflows. - [CREDENTIALS_UNSAFE]: The skill identifies and documents the use of environment variables like
TIANGONG_LCA_API_KEYfor authentication. The source code does not contain hardcoded secrets, and standard secret management practices (using environment variables) are followed. - [SAFE]: A review of the instructions and scripts shows no evidence of prompt injection, persistence mechanisms, or multi-layer obfuscation. The skill's behavior matches its stated purpose.
Audit Metadata