moai-workflow-templates
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [NO_CODE]: The skill does not include any executable scripts in its current configuration. The frontmatter explicitly sets scripts_enabled: false, indicating that the logic has been migrated elsewhere.
- [COMMAND_EXECUTION]: The documentation references the use of the uv command-line tool to execute Python-based template generators. These commands are provided as usage examples for developers and agents.
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a template engine which is a surface for indirect injection. * Ingestion points: Variables supplied via CLI arguments (e.g., name, description) and template files within the modules/ directory. * Boundary markers: The system uses a [REPLACE: ...] pattern to delimit areas where variable interpolation occurs. * Capability inventory: The documentation describes capabilities for file writing, directory creation, and running post-generation hooks (e.g., git init, install deps). * Sanitization: The skill identifies validation phases, including frontmatter validation and size checking (500-line limit), to prevent malformed or malicious template generation.
Audit Metadata