mvp-builder
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user descriptions of product ideas to generate structured documentation (MVP.md) and functional code slices.
- Ingestion points: User prompts triggers on terms like "MVP", "prototype", or "validate this idea" (SKILL.md).
- Boundary markers: Absent; the agent is not instructed to use specific delimiters for user input.
- Capability inventory: The agent is tasked with writing code and creating files in the project root (SKILL.md, Workflow Step 4).
- Sanitization: Absent at the prompt level, though the skill instructs the agent to include input validation in the generated code (SKILL.md, Workflow Step 5).
- [SAFE]: The skill proactively addresses common security pitfalls by including a "safety basics" section that mandates secret management and input validation in the generated prototypes.
Audit Metadata