70High
The skill forces the execution of an undefined, external setup command, creating a significant security risk by allowing arbitrary, potentially malicious environment configuration from an untrusted source.
Skill Info
Namemattpocock/skills/to-prd
Registrygithub
Version6eeb81b5fcfe
PURLpkg:github/mattpocock/skills@6eeb81b5fcfe?skill=to-prd
Stars137,192
Installs254,600
Source
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
GitHub
253,500 installs
Skills.shDocs
npx skills add https://github.com/mattpocock/skillsAssessments (3)
AI Agent Traps ↗Hidden dependency on external setup commandhighcommand executionAML.T0050AML.T0053AML.T0072LLM05:2025LLM06:2025
The skill mandates the execution of an arbitrary command '/setup-matt-pocock-skills' which is not defined in the package, potentially leading to unauthorized environment configuration or tool installation.
90% confidenceline 9
run `/setup-matt-pocock-skills` if not.
Potential for prompt injection via external setupmediumindirect prompt injection
The instruction to run an external setup command suggests that the agent's behavior and configuration are dependent on an external, potentially attacker-controlled source.
70% confidenceline 9
run `/setup-matt-pocock-skills` if not.
Missing usage exampleslowpolicy violation
Skill body contains no code blocks or usage examples, making it harder for users to evaluate.
100% confidence
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/mattpocock/skills/to-prd)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/mattpocock/skills/to-prd"><img src="https://mondoo.com/ai-agent-security/api/badge/github/mattpocock/skills/to-prd.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/mattpocock/skills/to-prd.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow