lifecyclemodel-hybrid-search
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION] (LOW): The skill ships with and executes a shell script
scripts/run-lifecyclemodel-hybrid-search.shto perform its primary function. While intended for utility, it represents a local command execution surface. - [DATA_EXFILTRATION] (LOW): The skill transmits data and an authorization token (
TIANGONG_LCA_APIKEY) to a non-whitelisted external domain (qgzvkongdjqiiamzbbts.supabase.co). This is functional behavior for this specific skill but qualifies as a network operation to a non-standard domain. - [INDIRECT_PROMPT_INJECTION] (LOW): The skill processes external data files via the
--dataflag without sanitization. - Ingestion points:
scripts/run-lifecyclemodel-hybrid-search.shreads from a file specified by the user or agent. - Boundary markers: Absent. The script directly cats the file content into the curl request.
- Capability inventory: Uses
curlto send POST requests. - Sanitization: None performed on the input file content.
Audit Metadata