mops-cli
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the
mopsCLI to download project dependencies from a package registry and GitHub (e.g.,mops add org/repo). It also manages the toolchain by downloading specific binary versions of the Motoko compiler (moc), linters (lintoko), and testing tools (pocket-ic) via commands likemops toolchain use. - [COMMAND_EXECUTION]: The instructions direct the agent to execute various
mopsCLI commands to perform project tasks such as installation, building, testing, and linting. These are standard operations for a software development toolchain. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and act upon Motoko project configuration files (
mops.toml,mops.lock) and source code (.mofiles). - Ingestion points: Reads project configuration from
mops.tomland dependency lockfiles. - Boundary markers: None explicitly defined in the instructions.
- Capability inventory: Execution of
mopsCLI, file system writes (build artifacts, configuration updates), and network access (package downloads). - Sanitization: Relies on the underlying
mopsCLI tool's internal validation of configuration and package integrity.
Audit Metadata