setup-matt-pocock-skills
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a legitimate scaffolding tool that automates the setup of repository documentation for AI agents. It does not contain malicious code, hidden instructions, or obfuscation.
- [COMMAND_EXECUTION]: The skill utilizes standard command-line tools such as
git,gh(GitHub CLI), andglab(GitLab CLI). These tools are used for repository exploration and issue management, which is consistent with the skill's stated purpose. - [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external data (issue trackers, ADRs, and CONTEXT.md files). It includes the following elements:
- Ingestion points: Reads data from external issue trackers (GitHub/GitLab) and local markdown files (
CONTEXT.md,docs/adr/) as defined inSKILL.mdand the template files. - Boundary markers: Uses structured markdown templates and user-confirmed configuration blocks to guide how subsequent skills interpret this data.
- Capability inventory: The skill performs file system exploration, repository status checks, and writes configuration files to
docs/agents/and root documentation files (CLAUDE.mdorAGENTS.md). - Sanitization: Relies on user confirmation and review of drafts before writing to disk.
- [DATA_EXFILTRATION]: Repository metadata is read locally via
git remote -vand.git/configinSKILL.mdto identify the project environment. There is no evidence of sensitive data being extracted or transmitted to third-party services.
Audit Metadata