reviewing-motoko
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run a command-line tool for automated code checking.
- Evidence: The procedure in
SKILL.mdincludes the execution ofmops check --fixto handle mechanical style fixes and redundant code patterns. - Context:
mopsis the standard package manager and toolchain for the Motoko ecosystem. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it is designed to ingest and analyze untrusted source code files.
- Ingestion points: The skill analyzes existing Motoko backend files (
.mo),mops.tomlconfiguration files, and migration chains. - Boundary markers: The skill provides a robust framework of specific design questions and severity-ranked findings (Blocker, Warning, Note) which helps the agent maintain a structured, objective analysis posture.
- Capability inventory: The skill utilizes the
mopsCLI for automated analysis and code modification. - Sanitization: No explicit content sanitization is described, as the skill is intended for technical audit by an AI agent.
Audit Metadata