The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill is configured to download and execute the latest version of the @tiangong-lca/cli package from the NPM registry using npm exec. Since this package belongs to the skill's author and is required for the stated functionality, this is considered a standard and safe dependency management practice.
[COMMAND_EXECUTION]: The provided Node.js script scripts/run-lifecyclemodel-hybrid-search.mjs acts as a launcher for the tiangong CLI. It constructs command arguments based on user input and environment variables, providing a controlled interface for interacting with the underlying search infrastructure.
[CREDENTIALS_UNSAFE]: The skill uses environment variables (TIANGONG_LCA_API_KEY) for authentication. Documentation and testing scripts correctly use placeholders (e.g., <your-api-key>) rather than hardcoding sensitive credentials, which aligns with security best practices for credential management.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data via JSON input files (e.g., assets/example-request.json). While this creates a potential surface for indirect injection, the skill's primary function is data retrieval rather than autonomous decision-making, and its instructions in references/prompts.md specifically mandate preserving structured filters and language neutrality, which serves as a prompt-level boundary.

lifecyclemodel-hybrid-search