mvp-builder-init
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill contains a fallback mechanism to download and execute an installer script from the vendor's official GitHub repository (github.com/app-builders-club/mvp-builder) using a
curlpiped tobashcommand. This fallback is triggered if the local version of the script included with the plugin is not found in the expected directory. - [COMMAND_EXECUTION]: The skill uses shell commands to check for the existence of an installer script and executes it with local arguments. These commands are used to copy project scaffolds, write manifests, and perform project migrations.
- [INDIRECT_PROMPT_INJECTION]: The skill represents a potential attack surface by ingesting user-provided arguments ($ARGUMENTS) and reading project-specific files like
CLAUDE.md. - Ingestion points: Project files and user-supplied command arguments.
- Boundary markers: None explicitly defined in the prompt instructions.
- Capability inventory: Execution of shell scripts and file system operations.
- Sanitization: The skill relies on the underlying shell script to validate inputs and handle file merging manually via the user.
Audit Metadata