coding-mojo
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches Mojo language syntax guides and skills from the official Modular repository on GitHub (
github.com/modular/skills) using the GitHub API. - [COMMAND_EXECUTION]: Installs the Mojo compiler and MAX tools using
uv pip installand executes shell commands to setup the development environment. - [DYNAMIC_EXECUTION]: Generates, compiles, and executes Mojo source code at runtime using
mojo buildand JIT execution modes. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external instruction sets from GitHub to guide its code generation process, creating a surface for indirect instructions to influence agent behavior.
- Ingestion points: Fetches
SKILL.mdcontent from themodular/skillsrepository viacurl. - Boundary markers: None identified for the fetched external content.
- Capability inventory: Can execute shell commands, compile binaries, and perform network requests using environment variables (
$GH_TOKEN). - Sanitization: None identified for the downloaded content before processing.
Audit Metadata