skills/fastmoss/cli/fastmoss-cli/Gen Agent Trust Hub

fastmoss-cli

Pass

Audited by Gen Agent Trust Hub on Jul 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill's primary function is to execute the fastmoss command-line tool. This is the intended purpose of the skill and involves calling specific subcommands like fastmoss call and fastmoss login to retrieve business data from the FastMoss platform.
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the @fastmoss/cli package from the npm registry. As this is a scoped package belonging to the skill's author ('FastMoss'), it is classified as a legitimate vendor resource required for the skill to operate.
  • [PROMPT_INJECTION]: Indirect prompt injection surface exists as the skill processes untrusted external data from TikTok (such as creator bios, product descriptions, and ad captions) returned by the API tools.
  • Ingestion points: Data enters the agent context through the output of commands like fastmoss call --tool ad_search or fastmoss call --tool video_script_info.
  • Boundary markers: The skill suggests using --output mcp which provides structured data, though explicit prompt delimiters for the ingested content are not defined in the provided files.
  • Capability inventory: The agent can execute the fastmoss CLI tool and summarize results.
  • Sanitization: No specific sanitization or filtering logic is provided within the instructions; the agent is expected to summarize the results for the user.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 13, 2026, 03:52 AM
Security Audit — agent-trust-hub — fastmoss-cli