reviewing-motoko
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use
mops check --fixfor automated code formatting and style checks. This is a standard developer tool within the Motoko ecosystem and is used here for its intended purpose of code maintenance. - [INDIRECT_PROMPT_INJECTION]: As an auditing skill, it is designed to process untrusted Motoko source files. While such files could contain adversarial instructions, the skill's detailed methodology and severity-ranked finding system provide a structured analysis process that mitigates the risk of the agent deviating from its primary task.
- Ingestion points: Reads
.mofiles,mops.toml, and migration files. - Boundary markers: The skill defines a strict order of operations and specific design criteria to guide the agent's analysis.
- Capability inventory: The agent can perform shell execution (
mops check --fix) and provide structured feedback. - Sanitization: The skill encourages using automated tools which apply standardized rules, reducing reliance on manual interpretation of code snippets.
Audit Metadata