skills/modu-ai/moai-cowork/project/Gen Agent Trust Hub

project

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill dynamically generates and manages instructions for the project coordinator (AGENTS.md) and specialized subagents (.claude/agents/*.md). It assembles these instructions at runtime by interpolating user-provided context and discovered plugin metadata into predefined templates.
  • [COMMAND_EXECUTION]: The skill relies on local shell commands to perform its core functions, such as scanning the filesystem for installed plugins in the user's home directory (~/.claude/plugins/ and ~/.codex/plugins/) and using utilities like grep, wc, and unzip for file validation and quality control.
  • [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes and incorporates external data—including plugin descriptions and user-supplied project goals—directly into the instructions that guide future agent actions. This creates a risk where malicious input could influence the generated project guidelines.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 04:23 PM