motion
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto download and run the@useclawlink/clipackage from the NPM registry, which is the primary interface for the service.- [COMMAND_EXECUTION]: Functionality is achieved through shell commands that execute the CLI tool for authentication and data management.- [INDIRECT_PROMPT_INJECTION]: The skill reads external data from the Motion platform (tasks, comments, user lists), which acts as a potential injection surface for untrusted content. - Ingestion points:
motion_list_tasks,motion_get_task, andmotion_list_commentsactions inSKILL.md. - Boundary markers: Absent.
- Capability inventory: Shell command execution and network access to the vendor's API via the CLI.
- Sanitization: Relies on the agent's internal safety guardrails.
Audit Metadata