reviewing-motoko
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run the
mops check --fixcommand.mopsis the standard, well-known package manager and linter for the Motoko programming language ecosystem. - [INDIRECT_PROMPT_INJECTION]: As a code review tool, the skill naturally processes untrusted external data (Motoko source code and project configuration files), creating a standard attack surface for indirect prompt injection.
- Ingestion points: Reads and analyzes Motoko source files (
.mo) and project configuration (mops.toml) provided by the user. - Boundary markers: The instructions do not define specific delimiters or 'ignore' instructions for the code being reviewed.
- Capability inventory: The skill includes the capability to execute
mops check --fixon the project files. - Sanitization: No specific sanitization of the input code is described; however, the skill's purpose is to find and report defects in that code rather than execute it directly.
Audit Metadata