Agent skill · Audited from source
grill-me
skill · mattpocock/skillsMIT licenceAudited 31 Oct 2026 · source dcb0b8cc0e4d
Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit dcb0b8cc0e4d and found no filesystem, network or shell access and no hard-coded secrets. The audit raised 3 findings, 1 critical or high. What it does: A relentless interview to sharpen a plan or design.
Cite
Cite this page
ModelsAtlas. “grill-me (mattpocock/skills)”. Retrieved 31 Oct 2026. https://modelsatlas.com/skills/mattpocock/grill-me
Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 1 critical or high finding, starting with “Privilege escalation / persistence” in SKILL.md. Do not install it without reading them.
4 skills are called “grill-me”. You are viewing mattpocock/skills. 1 of them is BLOCK.
- mattpocock/skills★ 308k✕BLOCK
- alirezarezvani/claude-skills★ 28k!CAUTION
- vinvcn/mattpocock-skills-zh-cn★ 5.4k✓SAFE
- julianoczkowski/designer-skills★ 592✓SAFE
Trust audit
Audit 0.4.1 · source read 31 Oct 2026
BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 721 of 17,602 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 1 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | NA | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | FAIL | 2 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (3)
HIGHPrivilege escalation / persistencereview.unsafe_action · SKILL.md
Call the Skill tool with "grilling".
- Why
- The hidden instruction silently triggers another skill without user awareness, contradicting the stated scope of a passive interview.
- Fix
- rewrite it so the instruction says plainly what it does, and asks the user before it acts
MEDIUMPrompt injectionreview.misleading_scope · SKILL.md
Call the Skill tool with "grilling".
- Why
- The package description promises a user-driven interview but secretly delegates behavior to an external, unreviewed component.
- Fix
- rewrite it so the instruction says plainly what it does, and asks the user before it acts
LOWInventory / provenanceinv.symlink · AGENTS.md
AGENTS.md
- Why
- link not followed
- Fix
- —
Audit 0.4.1 · source sha dcb0b8cc0e4d · 31 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publishermattpocock GitHub userOwner of the repository this skill is read from
- Source foldermattpocock/skills/skills/productivity/grill-meThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdictdcb0b8cc0e4dA new audit runs when the source changes
- Repository statusNot archivedPushed today
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: A relentless interview to sharpen a plan or design.
--- name: grill-me description: A relentless interview to sharpen a plan or design. disable-model-invocation: true --- Call the Skill tool with "grilling".
Excerpt, first 156 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit dcb0b8c
git clone https://github.com/mattpocock/skills git -C skills checkout dcb0b8cc0e4d
The author documents no install command, so this uses the repository directly. Our verdict covers commit dcb0b8cc0e4d only.
Works in
The author has not said which agents this skill supports, and we have not tested it in any.
Audit history
Every audit, every source change
- ✕BLOCK D 69 / 100
first audit · source
dcb0b8cc0e4d
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/mattpocock/grill-me/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
affaan-m/everything-claude-code
Django testing strategies with pytest-django, TDD methodology, factory_boy, mocking, coverage, and testing Django REST Framework APIs. Use when writing Django or DRF tests with pytest-django, or driving a Django feature…
affaan-m/ECC
Docker and Docker Compose patterns for local development, container security, networking, volume strategies, and multi-service orchestration. Use when setting up containerized development environments or reviewing…
nousresearch/hermes-agent
Delegate coding to Claude Code CLI (features, PRs).
Add this badge to your README
[](https://modelsatlas.com/skills/mattpocock/grill-me/)
<a href="https://modelsatlas.com/skills/mattpocock/grill-me/"><img src="https://modelsatlas.com/skills/mattpocock/grill-me/badge.svg" alt="ModelsAtlas: BLOCK D"></a>
Questions about grill-me
What does the grill-me skill do?
Is grill-me safe to install?
What can grill-me access on my machine?
How current is this page?
Sources
- github.com/mattpocock/skills/tree/main/skills/productivity/grill — the audited source at commit dcb0b8cc0e4d and every finding aboveObserved · 31 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the grill-me skill do?
- Is grill-me safe to install?
- What can grill-me access on my machine?