tidas-data-import
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
tiangong-lcaCLI,npm, andnodeto manage dataset orchestration, curation queues, and patch application. These operations are standard for the skill's documented purpose of data import and processing. - [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill resolves and executes additional logic from the vendor's repository (
https://github.com/tiangong-ai/skills) at runtime using thenpx skillscommand. This is used to incorporate specific research capabilities (e.g., academic search) into the authoring workflow. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted external data, including PDFs, Excel files, and academic journal papers, to generate structured TIDAS data using AI.
- Ingestion points: Processes source files from local paths and academic evidence retrieved via auxiliary research skills.
- Boundary markers: The skill includes a 'Boundaries' section in
SKILL.mdthat restricts the scope of the agent's orchestration and behavior. - Capability inventory: The skill possesses executable capabilities including CLI execution (
tiangong-lca,npx), local script execution (node,npm), and workspace file writing. - Sanitization: Implements a series of downstream gates, including schema validation, deterministic QA classification, and curation gate reviews, to verify AI-authored data before it is finalized.
Audit Metadata