moonpay-feedback
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
mpcommand-line interface, which is the official tool provided by MoonPay, to programmatically submit user feedback, bug reports, and feature requests. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided messages and interpolates them into a shell command argument, which represents a potential injection surface.
- Ingestion points: Feedback message input provided by the user in the
mp feedback createcommand. - Boundary markers: Double quotes are used to delimit the message string in the command examples (e.g.,
--message "<feedback message>"). - Capability inventory: Shell command execution via the
mpCLI. - Sanitization: No explicit sanitization or input escaping is defined within the skill file; the agent is expected to handle argument escaping during command execution.
Audit Metadata