coding-mojo

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches Mojo language syntax guides and skills from the official Modular repository on GitHub (github.com/modular/skills) using the GitHub API.
  • [COMMAND_EXECUTION]: Installs the Mojo compiler and MAX tools using uv pip install and executes shell commands to setup the development environment.
  • [DYNAMIC_EXECUTION]: Generates, compiles, and executes Mojo source code at runtime using mojo build and JIT execution modes.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external instruction sets from GitHub to guide its code generation process, creating a surface for indirect instructions to influence agent behavior.
  • Ingestion points: Fetches SKILL.md content from the modular/skills repository via curl.
  • Boundary markers: None identified for the fetched external content.
  • Capability inventory: Can execute shell commands, compile binaries, and perform network requests using environment variables ($GH_TOKEN).
  • Sanitization: None identified for the downloaded content before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 06:47 PM