moai-lang-cpp

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill's CMake configuration examples use FetchContent to download dependencies from their official GitHub repositories. This includes well-known libraries such as fmt, spdlog, googletest, and nlohmann_json. These downloads are standard practice for C++ development and target established community projects.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze C++ source code, build manifests, and package manager configurations, creating a surface for processing untrusted data.
  • Ingestion points: The agent triggers on and reads .cpp, .hpp, CMakeLists.txt, vcpkg.json, and conanfile.txt files (referenced in SKILL.md and references/examples.md).
  • Boundary markers: The instructions do not specify any boundary markers or special delimiters to separate untrusted code from agent instructions.
  • Capability inventory: The skill uses the Bash tool to execute compilers (g++, gcc, clang, clang++), build tools (cmake, make), testing frameworks (ctest), and debuggers/profilers (gdb, valgrind).
  • Sanitization: There are no documented procedures for sanitizing or validating the code ingested from the user's workspace before processing it.
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to use various build and diagnostic tools through a shell interface to compile, test, and profile C++ applications.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 03:48 AM