flow-hybrid-search
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and executes the
@tiangong-lca/clipackage from the NPM registry at runtime usingnpm exec. This package belongs to the skill's author and is used to provide the core search functionality. - [COMMAND_EXECUTION]: The wrapper script
scripts/run-flow-hybrid-search.mjsexecutes shell commands to invoke thetiangongCLI. It uses a structured argument array to forward user-provided flags to the underlying tool. - [DATA_EXFILTRATION]: The skill communicates with a Supabase edge function endpoint (
https://qgzvkongdjqiiamzbbts.supabase.co/functions/v1/flow_hybrid_search) to perform search operations. This network activity is consistent with the skill's primary purpose of querying a remote database. - [CREDENTIALS_UNSAFE]: Authentication is handled via the
TIANGONG_LCA_API_KEYenvironment variable. The skill documentation correctly instructs users to set this variable rather than hardcoding sensitive credentials in the scripts or prompts.
Audit Metadata