setup-mvskills

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands via gh, glab, pnpm, git, and docker to perform project setup tasks. These operations include configuring issue trackers, managing dependencies, running migrations, and verifying infrastructure connectivity. These commands are integral to the skill's primary purpose of project scaffolding.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from existing repository files such as package.json, AGENTS.md, CLAUDE.md, and local environment examples to determine the project's current state.
  • Ingestion points: git remote metadata, manifest files (package.json, pnpm-workspace.yaml), and existing markdown documentation (GLOSSARY.md, ADRs).
  • Boundary markers: The skill relies on natural language instructions to isolate setup phases but does not implement strict delimiters for all ingested data.
  • Capability inventory: Includes file system write access, repository management via gh/glab CLI, and local service management via docker and pnpm.
  • Sanitization: No specific sanitization logic is detailed for the ingested repository content, though the skill encourages human-in-the-loop confirmation before executing major changes.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 12:11 PM