mowgli
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
mowglicommand-line utility vianpxto interact with project metadata, version history, and design files. - [EXTERNAL_DOWNLOADS]: The skill uses
npx mowgli-cli, which downloads the vendor's command-line interface from the NPM registry if it is not already locally available. - [DATA_EXFILTRATION]: As part of its intended design synchronization feature, the skill transmits local source code (React components) and configuration files (Tailwind themes) to the remote Mowgli service at
app.mowgli.ai. - [PROMPT_INJECTION]: The skill implements security best practices by recommending the use of explicit boundary markers (
--- BEGIN FILE: <name> ---and--- END FILE: <name> ---) when interpolating untrusted codebase content into instructions for the Mowgli agent.
Audit Metadata