skills/momhq/mom/mom-status/Gen Agent Trust Hub

mom-status

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data returned from the mom status command, creating a potential vector for indirect instructions if the tool output is manipulated.
  • Ingestion points: The agent reads and processes the output of the mom status command as described in SKILL.md.
  • Boundary markers: The skill does not define specific delimiters to wrap the tool output, though it does instruct the agent to summarize rather than print raw output.
  • Capability inventory: The skill utilizes the Bash tool to execute status and setup commands.
  • Sanitization: The instructions explicitly require the agent to redact sensitive fields such as keys, tokens, and passwords using [REDACTED] and to summarize the output, which significantly mitigates the risk of data exposure.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the mom CLI tool from a remote repository via Homebrew.
  • Evidence: It suggests the command brew install momhq/tap/mom and references the source at https://github.com/momhq/mom. The resource belongs to the skill's vendor and the instructions explicitly forbid installation without user consent.
  • [COMMAND_EXECUTION]: The skill relies on shell commands to manage its environment and query its state.
  • Evidence: Uses command -v mom for path verification and mom status for operational reporting.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 08:44 AM