moshu-deslop
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Node.js scripts (
check-ai-patterns.js,check-degeneration.js,check-outline-copy.js,normalize-punctuation.js) to perform technical analysis and text transformations. These scripts are provided within the skill bundle and operate on local project files to identify stylistic patterns or normalize punctuation. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied novel text which serves as an entry point for untrusted data.
- Ingestion points: Novel text provided by the user is ingested during the desloping and detection stages (Stage 1-5).
- Boundary markers: The instructions do not define strict delimiters or isolation protocols to prevent the agent from interpreting instructions potentially embedded within the novel text.
- Capability inventory: The agent has the capability to execute shell commands (running the analysis scripts) and write to the filesystem (via the normalization script).
- Sanitization: There is no evidence of sanitization or filtering of the novel text before it is processed by the agent or passed to the analysis scripts.
Audit Metadata