skills/clawlink-hq/skills/motion/Gen Agent Trust Hub

motion

Pass

Audited by Gen Agent Trust Hub on Jun 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on shell commands using npx @useclawlink/cli to perform actions such as logging in, connecting to Motion, and executing API calls.
  • [EXTERNAL_DOWNLOADS]: Uses npx to download and execute the @useclawlink/cli package from the NPM registry. This is a standard method for distributing CLI tools and originates from the skill author's organization.
  • [DATA_EXPOSURE]: The skill documentation notes that credentials are stored locally at ~/.clawlink/credentials.json. This is standard behavior for CLI tools maintaining local session state.
  • [INDIRECT_PROMPT_INJECTION]: The skill has the capability to read Motion data such as task descriptions and comments (motion_list_tasks, motion_list_comments), which could potentially contain instructions intended to influence the agent's behavior. However, the skill includes a safety recommendation to 'confirm with the user before any write' operation.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 28, 2026, 02:42 PM
Security Audit — agent-trust-hub — motion