moai-lang-cpp
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's CMake configuration examples use
FetchContentto download dependencies from their official GitHub repositories. This includes well-known libraries such as fmt, spdlog, googletest, and nlohmann_json. These downloads are standard practice for C++ development and target established community projects. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze C++ source code, build manifests, and package manager configurations, creating a surface for processing untrusted data.
- Ingestion points: The agent triggers on and reads
.cpp,.hpp,CMakeLists.txt,vcpkg.json, andconanfile.txtfiles (referenced inSKILL.mdandreferences/examples.md). - Boundary markers: The instructions do not specify any boundary markers or special delimiters to separate untrusted code from agent instructions.
- Capability inventory: The skill uses the
Bashtool to execute compilers (g++,gcc,clang,clang++), build tools (cmake,make), testing frameworks (ctest), and debuggers/profilers (gdb,valgrind). - Sanitization: There are no documented procedures for sanitizing or validating the code ingested from the user's workspace before processing it.
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to use various build and diagnostic tools through a shell interface to compile, test, and profile C++ applications.
Audit Metadata