setup-matt-pocock-skills

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill is a legitimate scaffolding tool that automates the setup of repository documentation for AI agents. It does not contain malicious code, hidden instructions, or obfuscation.
  • [COMMAND_EXECUTION]: The skill utilizes standard command-line tools such as git, gh (GitHub CLI), and glab (GitLab CLI). These tools are used for repository exploration and issue management, which is consistent with the skill's stated purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external data (issue trackers, ADRs, and CONTEXT.md files). It includes the following elements:
  • Ingestion points: Reads data from external issue trackers (GitHub/GitLab) and local markdown files (CONTEXT.md, docs/adr/) as defined in SKILL.md and the template files.
  • Boundary markers: Uses structured markdown templates and user-confirmed configuration blocks to guide how subsequent skills interpret this data.
  • Capability inventory: The skill performs file system exploration, repository status checks, and writes configuration files to docs/agents/ and root documentation files (CLAUDE.md or AGENTS.md).
  • Sanitization: Relies on user confirmation and review of drafts before writing to disk.
  • [DATA_EXFILTRATION]: Repository metadata is read locally via git remote -v and .git/config in SKILL.md to identify the project environment. There is no evidence of sensitive data being extracted or transmitted to third-party services.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 04:20 PM