moonbit-toolchain

Pass

Audited by Gen Agent Trust Hub on Aug 8, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes scripts/env_report.ts, a TypeScript utility that executes standard system commands such as moon version, cc --version, and uname to verify the local environment. This is used for diagnostic purposes and relies on the standard node:child_process module.
  • [REMOTE_CODE_EXECUTION]: Documentation in references/workspaces-and-scripts.md and references/project-layout-and-config.md describes the MoonBit build system's capability to execute pre-build scripts and rules. The skill correctly identifies the security implications of these features, noting that pre-build steps are typically restricted for dependencies to prevent execution of arbitrary commands during builds.
  • [DATA_EXFILTRATION]: The skill implements a robust privacy policy in references/reporting-errors.md, which explicitly instructs the agent to scrub all sensitive information—including user project code, file paths, credentials, and environment variables—from any public issue reports generated to correct skill inaccuracies.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 8, 2026, 07:13 AM
Security Audit — agent-trust-hub — moonbit-toolchain