lifecyclemodel-resulting-process-builder
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill is configured to fetch and execute the
@tiangong-lca/clipackage from the npm registry usingnpm exec. This is the documented method for running the vendor's command-line tools for model processing. - [COMMAND_EXECUTION]: The script
scripts/run-lifecyclemodel-resulting-process-builder.mjsexecutes shell commands to invoke thetiangongCLI. This process handles the generation of projection artifacts and publication bundles from local lifecycle model files. - [CREDENTIALS_UNSAFE]: The skill documentation and request schema account for the use of
TIANGONG_LCA_API_KEYto support remote data lookups. These credentials are provided via environment variables or CLI arguments rather than being hardcoded, adhering to standard secret management practices.
Audit Metadata