moshu-build
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: A comprehensive security audit was performed on all 63 files of the moshu-build skill, and no malicious patterns or vulnerabilities were identified. The skill instructions and associated methodologies focus on structured writing workflows and consistency tracking.
- [COMMAND_EXECUTION]: The skill includes two Python scripts, impact_scan.py and tracking_commit.py, which are used to analyze keyword impact and manage character/plot state files. These scripts rely exclusively on the Python standard library, perform only local file I/O operations within the project directory, and do not execute external commands or interact with any network endpoints.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect injection by reading novel prose and outline files during impact scanning. However, the associated scripts are read-only regarding prose files and do not contain exploitable capabilities that could lead to privilege escalation or data exfiltration, rendering this risk negligible in its intended local environment.
Audit Metadata