AI security review — mattpocock-skills
Plugin: mattpocock/skills · 253k stars · MIT
Reviewer: Fable 5.1 · Date: 6 September 2026
Grade: A · Risk: none
What it is
Matt Pocock’s engineering skills for Claude Code — grilling a spec, diagnosing bugs, TDD, code review, domain modelling, and a handful of writing and productivity helpers. The plugin bundles a manifest, thirty-seven skills, and two instruction files.
What I looked at
The manifest lists each skill by path and carries nothing else — no MCP servers, no install step. I read all thirty-nine files that ship with it.
Findings
Almost everything came back clean. Two things are worth naming.
The git-guardrails-claude-code skill installs git hooks by editing .claude/settings.json, and before it does, it asks whether you want them for this project only or for every project. Editing your settings is exactly the kind of thing a review should point out, so I have marked it low risk rather than none — not because it does anything sneaky, but because you should know a skill is changing your configuration. It is transparent about it.
The diagnosing-bugs skill was flagged for a network reference; on reading it, the mention is about naming a single test command, not making a call. False positive.
| Item | Flag | Verdict |
|---|---|---|
git-guardrails-claude-code | edits .claude/settings.json | legitimate, asks first — low risk, worth knowing |
diagnosing-bugs | network call | false positive — no call is made |
A full read for piped installers, eval, credential access, and exfiltration found none.
Verdict
A clean, plug-and-play set of engineering skills. The only thing that touches your machine’s config is git-guardrails, and it asks first. Grade A.
_Produced by agentmods.dev — automated AI security review. Reviewer model: Fable 5.1. Date: 6 September 2026. How this review works: https://agentmods.dev/about#security _