Is productivity/grill-me safe?
https://github.com/mattpocock/skills/tree/main/skills/productivity/grill-me
The grill-me skill is an extremely minimal productivity tool consisting of two declarative files with no executable code, no data-access directives, and no prompt injection payloads. All suspicious-looking filesystem events in the monitoring window are attributable to the audit pipeline's own baseline operations, occurring before the skill was installed, and the canary integrity check confirms no honeypot data was accessed or exfiltrated by the skill itself. The only outstanding consideration is that the 'grilling' sub-skill it delegates to was not co-audited and should be reviewed independently.
Category Scores
Findings (5)
LOW Canary files accessed within monitoring window -7 ▶
Inotify and auditd records show reads of six sensitive canary files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, .config/gcloud/application_default_credentials.json). All first-batch accesses occur at 00:29:02 / timestamp 1787185742 — approximately 6 seconds before the git clone begins (network to GitHub starts at 1787185748). The second batch at 1787185754 coincides with the audit pipeline's post-install file scan. No matching write or exfiltration events observed. Canary integrity check passed. Attribution: audit pipeline baseline operations, not the skill.
INFO Skill delegates to unverified 'grilling' sub-skill -3 ▶
The entire behavioral surface of SKILL.md is a single line delegating to another skill named 'grilling'. This is a normal composition pattern but means trust in this skill also depends on whatever 'grilling' resolves to in the host agent's skill registry. The target skill was not part of this audit.
INFO Ubuntu MOTD scripts fire on SSH login — expected noise -5 ▶
Multiple execve events for /etc/update-motd.d/* scripts (00-header, 50-landscape-sysinfo, 90-updates-available, etc.) and a connection to 185.125.190.48:443 (Ubuntu Launchpad) are present. This is standard Ubuntu SSH login behavior unrelated to the skill being audited.
INFO No executable code, hooks, or package manifests present -1 ▶
The baseline filesystem diff confirms only two files were added. No code, no package.json, no git hooks, no submodules, no gitattributes filters, and no symlinks. Attack surface from code execution is zero.
INFO Composition dependency on 'grilling' skill is the only unverified element -7 ▶
The skill cannot harm a user on its own — it contains no instructions that touch files, network, or shell. The only theoretical attack path would be if the 'grilling' skill it delegates to were itself malicious, but that is a supply-chain concern for that skill, not this one.