mvp
Pass
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill reads local project metadata from files such as package manifests and CI configurations to provide a summary to the user and automate documentation.
- [EXTERNAL_DOWNLOADS]: The skill performs network queries to public package registries (npm, PyPI, crates.io, Homebrew) to check for project name availability.
- [PROMPT_INJECTION]: The skill relies on existing project documentation files as its primary state memory, which introduces a surface for indirect prompt injection.
- Ingestion points: Reads existing ROADMAP.md, PRD.md, or MVP.md files to initialize or update project state.
- Boundary markers: Absent; the agent is instructed to treat these files as the authoritative record of what was decided and done.
- Capability inventory: The skill has the ability to write to files, query external registries, and interact with the user via structured questions.
- Sanitization: No specific sanitization or filtering of the content within the ingested markdown files is described.
Audit Metadata