setup-mvskills
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands via
gh,glab,pnpm,git, anddockerto perform project setup tasks. These operations include configuring issue trackers, managing dependencies, running migrations, and verifying infrastructure connectivity. These commands are integral to the skill's primary purpose of project scaffolding. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from existing repository files such as
package.json,AGENTS.md,CLAUDE.md, and local environment examples to determine the project's current state. - Ingestion points:
git remotemetadata, manifest files (package.json,pnpm-workspace.yaml), and existing markdown documentation (GLOSSARY.md,ADRs). - Boundary markers: The skill relies on natural language instructions to isolate setup phases but does not implement strict delimiters for all ingested data.
- Capability inventory: Includes file system write access, repository management via
gh/glabCLI, and local service management viadockerandpnpm. - Sanitization: No specific sanitization logic is detailed for the ingested repository content, though the skill encourages human-in-the-loop confirmation before executing major changes.
Audit Metadata