mom-project
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill manages the installation of the mom utility from the author's official Homebrew repository (momhq/tap/mom). This is a functional requirement for the skill and targets the vendor's own resources.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local configuration files, which presents a surface for indirect prompt injection.
- Ingestion points: The skill reads the .mom-project.yaml file to identify the current project state.
- Boundary markers: There are no specific delimiters used when reading the file content.
- Capability inventory: The skill can execute shell commands for project management and tool installation.
- Sanitization: The skill follows best practices by requiring explicit user confirmation for proposed project IDs and before initiating the installation of the external tool.
Audit Metadata