mo
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches a CLI binary from the author's repository (
github.com/mnhkahn/cyeam-cli). - [COMMAND_EXECUTION]: Uses
chmod +xto grant executable permissions to the downloaded binary. - [COMMAND_EXECUTION]: Employs
sudo mvto install the tool into a system directory (/usr/local/bin), which requires administrative access. - [DATA_EXFILTRATION]: The OCR command (
cyeam mo ocr) uploads local images to the vendor's domain (cyeam.com) for analysis. - [PROMPT_INJECTION]: The skill processes untrusted image data through OCR, presenting a surface for indirect prompt injection.
- Ingestion points: Image file processing via the
ocrcommand inSKILL.md. - Boundary markers: None specified for the OCR output.
- Capability inventory: Executes external binaries and performs network uploads.
- Sanitization: No explicit sanitization or filtering of OCR results is documented.
Audit Metadata