mvpfy-setup
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill executes
npx --yes @promovaweb/mvpfy install, which downloads and runs an installation package from the vendor's repository. - [COMMAND_EXECUTION]: The instructions command the execution of shell tools including
mvpfy doctor,mvpfy progress, andmvpfy updateto verify and manage the project environment. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8).
- Ingestion points: Reads existing instructions and the
MVP.mdfile from the consumer project root (SKILL.md). - Boundary markers: No delimiters or 'ignore embedded instructions' warnings are present when reading external project data.
- Capability inventory: The skill has the capability to execute shell commands (
npx,mvpfy) which could be abused if malicious instructions are present in the project files. - Sanitization: There is no evidence of validation or filtering for the content ingested from the project's local files.
Audit Metadata