onboard-context-matic
Pass
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a guided, interactive tour of the context-matic MCP server to help users understand its capabilities.
- [COMMAND_EXECUTION]: The skill performs project language detection by checking for common filenames like package.json or requirements.txt. This is a standard, benign practice for providing context-aware documentation.
- [PROMPT_INJECTION]: The skill processes user queries and workspace data, creating a surface for indirect prompt injection. Ingestion points: workspace files (Phase 1a) and user queries (Phase 4). Boundary markers: None. Capability inventory: Uses read-only tools (fetch_api, ask, model_search, endpoint_search) to retrieve documentation. Sanitization: None. The risk is considered minimal as the skill only presents documentation to the user and does not execute actions based on the content.
Audit Metadata