fastmoss-cli
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill's primary function is to execute the
fastmosscommand-line tool. This is the intended purpose of the skill and involves calling specific subcommands likefastmoss callandfastmoss loginto retrieve business data from the FastMoss platform. - [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
@fastmoss/clipackage from the npm registry. As this is a scoped package belonging to the skill's author ('FastMoss'), it is classified as a legitimate vendor resource required for the skill to operate. - [PROMPT_INJECTION]: Indirect prompt injection surface exists as the skill processes untrusted external data from TikTok (such as creator bios, product descriptions, and ad captions) returned by the API tools.
- Ingestion points: Data enters the agent context through the output of commands like
fastmoss call --tool ad_searchorfastmoss call --tool video_script_info. - Boundary markers: The skill suggests using
--output mcpwhich provides structured data, though explicit prompt delimiters for the ingested content are not defined in the provided files. - Capability inventory: The agent can execute the
fastmossCLI tool and summarize results. - Sanitization: No specific sanitization or filtering logic is provided within the instructions; the agent is expected to summarize the results for the user.
Audit Metadata