mo-qa
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the 'mo' CLI using a piped shell command from 'https://cli.momentic.ai/mo'. This is documented as the standard installation method for the vendor's tool.
- [REMOTE_CODE_EXECUTION]: The installation process involves piping a remote script directly into a shell ('curl | sh'). This behavior is limited to the initial setup of the vendor's official CLI tool.
- [COMMAND_EXECUTION]: The skill frequently invokes the 'mo' CLI tool to start sessions, read status, and manage tunnels. These are the core functional requirements of the skill.
- [DATA_EXFILTRATION]: The skill facilitates file transfers ('mo upload' and 'mo download') between the local machine and a hosted sandbox environment. This is the intended primary purpose of the skill for providing test data to the QA agent.
- [CREDENTIALS_UNSAFE]: The skill manages authentication via 'mo login', which stores an API key in '~/.momentic/auth.json'. It explicitly instructs the agent to treat these credentials as sensitive and never print or commit them.
Audit Metadata