skills/shkarupa-alex/meta-o/mo-setup/Gen Agent Trust Hub

mo-setup

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes various system tools including git, orca, gh, glab, jq, and flock to inspect the project environment and manage issue reporting. It also utilizes custom shell and Node.js scripts (mo-posture.sh, mo-harness-screen.mjs, mo-backlog.mjs) for specialized checks.
  • [DYNAMIC_EXECUTION]: The skill performs dynamic execution in two ways: the mo-posture.sh script executes shell probe strings to detect environment shadowing, and the main instructions identify and execute a 'history stage' command extracted from the project's AGENTS.md file. This execution is strictly scoped to a disposable clone with no network access and defined time limits to prevent persistent side effects or data exfiltration.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests various project-level documents as data. To mitigate injection risks, it uses mature structural libraries like mdast-util-from-markdown and js-yaml for parsing. The skill's ability to create external issues via gh or glab is restricted to the project's own repository and is intended only for reporting methodology-related friction.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 07:03 PM