Skip to content
Report library
Purpose / Other

Setup Matt Pocock Skills Skill Security Audit

What the author says it does (original text)

Configure this repo for the engineering skills: set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.

Independent security check

Security risks found

Files checked
7
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Exploring and reporting Git remote configuration may expose credentials embedded in URLs

Source references: 2
What we found

The Skill explicitly reads `git remote -v` and `.git/config`, then summarizes its findings. Older repositories or automation environments sometimes embed access tokens, usernames, or passwords in remote URLs, but the instructions do not require redacting URL userinfo, tokens, or query parameters before presentation.

Why this matters

If the agent reproduces the remote URL, credentials could enter chat history, logs, or later model context and enable access to the associated hosting account or repository.

The Skill inspects `git remote -v` and `.git/config`, then summarizes its findings to the user. If a remote URL embeds a username, password, access token, or sensitive query parameter and the agent reproduces it verbatim, that credential could enter chat or logs. The source does not require redaction. A user can ask the author to report only the hosting service and repository name and to strip URL userinfo, tokens, and query parameters before display.

SKILL.md:21In the instructionsOpen original file
Look at the current repo to understand its starting state. Read whatever exists; don't assume:- `git remote -v` and `.git/config`: is this a GitHub repo? Which one?- `AGENTS.md` and `CLAUDE.md` at the repo root: does either exist? Is there already an `## Agent skills` section in either?- `CONTEXT.md` and `CONTEXT-MAP.md` at the repo root- `docs/adr/` and any `src/*/docs/adr/` directories- `docs/agents/`: does this skill's prior output already exist?- `.scratch/`: a sign that a local-markdown issue tracker convention is already in use- Is the `triage` skill installed? (a `triage` skill folder alongside this one, or `triage` in your available skills.) This decides whether Section B runs at all.- Monorepo signals: a `pnpm-workspace.yaml`, a `workspaces` field in `package.json`, or a populated `packages/*` with its own `src/`. These are present only in a genuinely large multi-package repo; their absence means single-context, which is almost every repo.
Show 1 other places
SKILL.md:32In the instructionsOpen original file
### 2. Present findings and askSummarise what's present and what's missing. Then take the sections in order. One section, one answer, then the next.Lead each section with the recommended answer so the user can accept it in a word. Give a one-line explainer only when the choice genuinely branches; skip the section entirely when exploration already settled it (Section B when `triage` isn't installed, Section C when there's no monorepo).
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

Later agents read external tickets and comments without being told to treat them as untrusted

Source references: 6
What we found

The installed templates tell later Skills to fetch ticket bodies, comments, and external contributors' PRs/MRs while also providing operations to comment, label, assign, and close items. They never explicitly say to ignore agent-directed instructions embedded in those bodies or comments. An attacker can place prompt-injection text in a public ticket or comment.

Why this matters

If a later agent treats external text as operational instructions, it could post misleading comments, change labels, claim work, or close tickets, altering the project queue and communications with collaborators.

This Skill installs tracker instructions that tell later Skills to read issue bodies and comments and also permit commenting, relabeling, and closing. If the PR request surface is enabled, they additionally inspect external contributors' PRs, comments, and diffs. Public content can contain text designed to induce unauthorized writes, while the template does not say to treat it as untrusted data. Impact depends on whether a later agent follows that text and on its account permissions. Users can restrict tokens to read-only and require confirmation before writes, assignment, or closure.

SKILL.md:104In the instructionsOpen original file
Then write the docs files using the seed templates in this skill folder as a starting point:- [issue-tracker-github.md](./issue-tracker-github.md): GitHub issue tracker- [issue-tracker-gitlab.md](./issue-tracker-gitlab.md): GitLab issue tracker- [issue-tracker-local.md](./issue-tracker-local.md): local-markdown issue tracker- [triage-labels.md](./triage-labels.md): label mapping (only if `triage` is installed)- [domain.md](./domain.md): domain doc consumer rules + layout
Show 5 other places
issue-tracker-github.md:8In the instructionsOpen original file
- **Create an issue**: `gh issue create --title "..." --body "..."`. Use a heredoc for multi-line bodies.- **Read an issue**: `gh issue view <number> --comments`, filtering comments by `jq` and also fetching labels.- **List issues**: `gh issue list --state open --json number,title,body,labels,comments --jq '[.[] | {number, title, body, labels: [.labels[].name], comments: [.comments[].body]}]'` with appropriate `--label` and `--state` filters.- **Comment on an issue**: `gh issue comment <number> --body "..."`- **Apply / remove labels**: `gh issue edit <number> --add-label "..."` / `--remove-label "..."`- **Close**: `gh issue close <number> --comment "..."`
issue-tracker-github.md:22In the instructionsOpen original file
- **Read a PR**: `gh pr view <number> --comments` and `gh pr diff <number>` for the diff.- **List external PRs for triage**: `gh pr list --state open --json number,title,body,labels,author,authorAssociation,comments` then keep only `authorAssociation` of `CONTRIBUTOR`, `FIRST_TIME_CONTRIBUTOR`, or `NONE` (drop `OWNER`/`MEMBER`/`COLLABORATOR`).- **Comment / label / close**: `gh pr comment`, `gh pr edit --add-label`/`--remove-label`, `gh pr close`.
issue-tracker-gitlab.md:23In the instructionsOpen original file
- **Read an MR**: `glab mr view <number> --comments` and `glab mr diff <number>` for the diff.- **List external MRs for triage**: `glab mr list -F json`, then keep only MRs whose author is not a project member/owner (a contributor's MR, not a maintainer's in-flight work).- **Comment / label / close**: `glab mr note`, `glab mr update --label`/`--unlabel`, `glab mr close`.
issue-tracker-github.md:7In the instructionsOpen original file
- **Create an issue**: `gh issue create --title "..." --body "..."`. Use a heredoc for multi-line bodies.- **Read an issue**: `gh issue view <number> --comments`, filtering comments by `jq` and also fetching labels.- **List issues**: `gh issue list --state open --json number,title,body,labels,comments --jq '[.[] | {number, title, body, labels: [.labels[].name], comments: [.comments[].body]}]'` with appropriate `--label` and `--state` filters.- **Comment on an issue**: `gh issue comment <number> --body "..."`- **Apply / remove labels**: `gh issue edit <number> --add-label "..."` / `--remove-label "..."`- **Close**: `gh issue close <number> --comment "..."`
issue-tracker-github.md:18In the instructionsOpen original file
**PRs as a request surface: no.** _(Set to `yes` if this repo treats external PRs as feature requests; `/triage` reads this flag.)_When set to `yes`, PRs run through the same labels and states as issues, using the `gh pr` equivalents:- **Read a PR**: `gh pr view <number> --comments` and `gh pr diff <number>` for the diff.- **List external PRs for triage**: `gh pr list --state open --json number,title,body,labels,author,authorAssociation,comments` then keep only `authorAssociation` of `CONTRIBUTOR`, `FIRST_TIME_CONTRIBUTOR`, or `NONE` (drop `OWNER`/`MEMBER`/`COLLABORATOR`).- **Comment / label / close**: `gh pr comment`, `gh pr edit --add-label`/`--remove-label`, `gh pr close`.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

The Skill cannot be invoked implicitly by the model and specifies an explore, present, confirm, then write workflow; the user can review drafts before files are written.

View source
agents/openai.yaml:4In the instructionsOpen original file
  short_description: "Configure a repo for the skills"policy:  allow_implicit_invocation: false
SKILL.md:15In the instructionsOpen original file
This is a prompt-driven skill, not a deterministic script. Explore, present what you found, confirm with the user, then write.
SKILL.md:63In the instructionsOpen original file
### 3. Confirm and editShow the user a draft of:- The `## Agent skills` block to add to whichever of `CLAUDE.md` / `AGENTS.md` is being edited (see step 4 for selection rules)- The contents of `docs/agents/issue-tracker.md`, `docs/agents/domain.md`, and `docs/agents/triage-labels.md` (the last only when `triage` is installed)Let them edit before writing.

After confirmation, the Skill persistently modifies the existing CLAUDE.md or AGENTS.md and writes configuration under docs/agents/. It requires updating an existing block in place while preserving surrounding user content.

View source
SKILL.md:74In the instructionsOpen original file
**Pick the file to edit:**- If `CLAUDE.md` exists, edit it.- Else if `AGENTS.md` exists, edit it.- If neither exists, ask the user which one to create; don't pick for them.Never create `AGENTS.md` when `CLAUDE.md` already exists (or vice versa); always edit the one that's already there.If an `## Agent skills` block already exists in the chosen file, update its contents in-place rather than appending a duplicate. Don't overwrite user edits to the surrounding sections.
SKILL.md:104In the instructionsOpen original file
Then write the docs files using the seed templates in this skill folder as a starting point:- [issue-tracker-github.md](./issue-tracker-github.md): GitHub issue tracker- [issue-tracker-gitlab.md](./issue-tracker-gitlab.md): GitLab issue tracker- [issue-tracker-local.md](./issue-tracker-local.md): local-markdown issue tracker- [triage-labels.md](./triage-labels.md): label mapping (only if `triage` is installed)- [domain.md](./domain.md): domain doc consumer rules + layoutFor "other" issue trackers, write `docs/agents/issue-tracker.md` from scratch using the user's description.

The generated tracker document becomes operational guidance for later engineering Skills. The GitHub/GitLab templates permit reading, creating, commenting, labeling, assigning, and closing remote tickets, while the local template modifies files under .scratch/.

View source
SKILL.md:38In the instructionsOpen original file
**Section A: Issue tracker.**> Explainer: The "issue tracker" is where issues live for this repo. Skills like `to-tickets`, `triage`, and `to-spec` read from and write to it. They need to know whether to call `gh issue create`, write a markdown file under `.scratch/`, or follow some other workflow you describe. Pick the place you actually track work for this repo.Default posture: these skills were designed for GitHub. If a `git remote` points at GitHub, propose that. If a `git remote` points at GitLab (`gitlab.com` or a self-hosted host), propose GitLab. Otherwise (or if the user prefers), offer:- **GitHub**: issues live in the repo's GitHub Issues (uses the `gh` CLI)- **GitLab**: issues live in the repo's GitLab Issues (uses the [`glab`](https://gitlab.com/gitlab-org/cli) CLI)- **Local markdown**: issues live as files under `.scratch/<feature>/` in this repo (good for solo projects or repos without a remote)- **Other** (Jira, Linear, etc.): ask the user to describe the workflow in one paragraph; the skill will record it as freeform proseRecord the choice in `docs/agents/issue-tracker.md`. The GitHub and GitLab templates carry a "PRs as a request surface" flag, defaulted **off**. Leave it off and don't raise it: a user who wants external PRs in the triage queue can flip the flag in the file later.
issue-tracker-github.md:7In the instructionsOpen original file
- **Create an issue**: `gh issue create --title "..." --body "..."`. Use a heredoc for multi-line bodies.- **Read an issue**: `gh issue view <number> --comments`, filtering comments by `jq` and also fetching labels.- **List issues**: `gh issue list --state open --json number,title,body,labels,comments --jq '[.[] | {number, title, body, labels: [.labels[].name], comments: [.comments[].body]}]'` with appropriate `--label` and `--state` filters.- **Comment on an issue**: `gh issue comment <number> --body "..."`- **Apply / remove labels**: `gh issue edit <number> --add-label "..."` / `--remove-label "..."`- **Close**: `gh issue close <number> --comment "..."`
issue-tracker-local.md:25In the instructionsOpen original file
- **Map**: `.scratch/<effort>/map.md` (the Notes / Decisions-so-far / Fog body).- **Child ticket**: `.scratch/<effort>/issues/NN-<slug>.md`, numbered from `01`, with the question in the body. A `Type:` line records the ticket type (`research`/`prototype`/`grilling`/`task`); a `Status:` line records `claimed`/`resolved`.- **Blocking**: a `Blocked by: NN, NN` line near the top. A ticket is unblocked when every file it lists is `resolved`.- **Frontier**: scan `.scratch/<effort>/issues/` for files that are open, unblocked, and unclaimed; first by number wins.- **Claim**: set `Status: claimed` and save before any work.- **Resolve**: append the answer under an `## Answer` heading, set `Status: resolved`, then append a context pointer (gist + link) to the map's Decisions-so-far in `map.md`.
Start here · InstructionsSKILL.md
setup-matt-pocock-skills
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 5
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records7 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • domain.mdFull text included
  • issue-tracker-github.mdFull text included
  • issue-tracker-gitlab.mdFull text included
  • issue-tracker-local.mdFull text included
  • triage-labels.mdFull text included
  • agents/openai.yamlFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • agents/openai.yamlSupporting file
  • domain.mdSupporting file
  • issue-tracker-github.mdSupporting file
  • issue-tracker-gitlab.mdSupporting file
  • issue-tracker-local.mdSupporting file
  • triage-labels.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:45In the instructionsOpen original file
- **GitHub**: issues live in the repo's GitHub Issues (uses the `gh` CLI)- **GitLab**: issues live in the repo's GitLab Issues (uses the [`glab`](https://gitlab.com/gitlab-org/cli) CLI)- **Local markdown**: issues live as files under `.scratch/<feature>/` in this repo (good for solo projects or repos without a remote)
issue-tracker-gitlab.md:3In the instructionsOpen original file
Issues and specs for this repo live as GitLab issues. Use the [`glab`](https://gitlab.com/gitlab-org/cli) CLI for all operations.
Read files
SKILL.md:116In the instructionsOpen original file
Tell the user the setup is complete and which engineering skills will now read from these files. Mention they can edit `docs/agents/*.md` directly later; re-running this skill is only necessary if they want to switch issue trackers or restart from scratch.
issue-tracker-local.md:19In the instructionsOpen original file
Read the file at the referenced path. The user will normally pass the path or the issue number directly.
Lines read
315
File checksum (to compare versions)
72b5b8c88d3092b9a4f61131881c005aea912e9df0504260744d8a6659e70371