The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from the local development environment.
Ingestion points: Commands such as vscode.file.read, vscode.git.diff, and vscode.editor.active in SKILL.md allow the agent to read file contents and git history that may contain malicious instructions.
Boundary markers: The skill instructions do not specify the use of delimiters or 'ignore' instructions for the data it processes.
Capability inventory: The skill possesses significant capabilities, including file modification (vscode.file.write), terminal execution (vscode.terminal.run), and delegation to other AI agents (vscode.agent.run).
Sanitization: The skill documentation notes that absolute paths and parent directory traversals (../) are blocked, restricting operations to the workspace root.
[DATA_EXFILTRATION]: The skill can be used to access sensitive information stored within the workspace directory.
Evidence: The vscode.file.read command allows the agent to read any file relative to the workspace root, which could include environment variables (.env), local configuration files, or private keys if stored in the project folder.
[COMMAND_EXECUTION]: The skill provides pathways for executing code and shell commands on the host machine via the connected IDE.
Evidence: The skill includes a vscode.terminal.run command and the ability to delegate tasks to the Cursor Agent via vscode.agent.run, which can perform autonomous operations on the codebase.

vscode-node