70High
The skill exhibits insecure design by bypassing model invocation restrictions and blindly executing unverified external skills, creating a significant risk of malicious sub-agent hijacking.
HygienePackaging & Manifest2 findings
Skill Info
Namemattpocock/skills/grill-with-docs
Registrygithub
Version6eeb81b5fcfe
PURLpkg:github/mattpocock/skills@6eeb81b5fcfe?skill=grill-with-docs
Stars137,192
Installs286,100
Source
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
GitHub
284,900 installs
Skills.shDocs
npx skills add https://github.com/mattpocock/skillsAssessments (3)
AI Agent Traps ↗Description Mismatchhighdescription mismatchAML.T0011.000LLM06:2025LLM09:2025
The skill manifest explicitly sets 'disable-model-invocation: true', yet the skill's core functionality relies on invoking other skills (which likely require model invocation) to perform its logic.
85% confidence
Manifest contains 'disable-model-invocation: true' while the execution logic calls '/grilling' and '/domain-modeling'.
Unverified sub-agent dependencyhighsub agent spawningAML.T0053AML.T0051.001LLM06:2025
The skill instructs the agent to invoke an external skill ('/domain-modeling') without verifying its origin, integrity, or existence, creating a potential vector for malicious sub-agent hijacking.
80% confidence
Run a /grilling session, using the /domain-modeling skill.
Missing usage exampleslowpolicy violation
Skill body contains no code blocks or usage examples, making it harder for users to evaluate.
100% confidence
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Version History (2)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/mattpocock/skills/grill-with-docs)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/mattpocock/skills/grill-with-docs"><img src="https://mondoo.com/ai-agent-security/api/badge/github/mattpocock/skills/grill-with-docs.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/mattpocock/skills/grill-with-docs.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow