tidas-data-import

Pass

Audited by Gen Agent Trust Hub on Jul 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the tiangong-lca CLI, npm, and node to manage dataset orchestration, curation queues, and patch application. These operations are standard for the skill's documented purpose of data import and processing.
  • [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill resolves and executes additional logic from the vendor's repository (https://github.com/tiangong-ai/skills) at runtime using the npx skills command. This is used to incorporate specific research capabilities (e.g., academic search) into the authoring workflow.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted external data, including PDFs, Excel files, and academic journal papers, to generate structured TIDAS data using AI.
  • Ingestion points: Processes source files from local paths and academic evidence retrieved via auxiliary research skills.
  • Boundary markers: The skill includes a 'Boundaries' section in SKILL.md that restricts the scope of the agent's orchestration and behavior.
  • Capability inventory: The skill possesses executable capabilities including CLI execution (tiangong-lca, npx), local script execution (node, npm), and workspace file writing.
  • Sanitization: Implements a series of downstream gates, including schema validation, deterministic QA classification, and curation gate reviews, to verify AI-authored data before it is finalized.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 23, 2026, 08:31 PM
Security Audit — agent-trust-hub — tidas-data-import