moonbit-toolchain
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes
scripts/env_report.ts, a TypeScript utility that executes standard system commands such asmoon version,cc --version, andunameto verify the local environment. This is used for diagnostic purposes and relies on the standardnode:child_processmodule. - [REMOTE_CODE_EXECUTION]: Documentation in
references/workspaces-and-scripts.mdandreferences/project-layout-and-config.mddescribes the MoonBit build system's capability to execute pre-build scripts and rules. The skill correctly identifies the security implications of these features, noting that pre-build steps are typically restricted for dependencies to prevent execution of arbitrary commands during builds. - [DATA_EXFILTRATION]: The skill implements a robust privacy policy in
references/reporting-errors.md, which explicitly instructs the agent to scrub all sensitive information—including user project code, file paths, credentials, and environment variables—from any public issue reports generated to correct skill inaccuracies.
Audit Metadata