cursor-build-loop
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon instructions found in local project files such as
docs/ROADMAP.md,docs/REFACTOR.md, anddocs/SECURITY-AUDIT.md. - Ingestion points: Plan files and task lists within the repository are used as the primary source of work instructions for the agent (SKILL.md).
- Boundary markers: The instructions do not define delimiters or provide warnings to the agent to distinguish between its own system instructions and potentially malicious content embedded in the plan files.
- Capability inventory: The agent has the capability to modify codebase files (Build step) and execute shell commands (Test step), which could be abused if malicious instructions are present in the plan files.
- Sanitization: Content from plan files is processed directly without any validation, filtering, or escaping of the input data.
- [COMMAND_EXECUTION]: The skill requires the agent to run the application and execute full test suites to verify implementation. This grants the agent the authority to run arbitrary code and scripts defined in the local development environment.
Audit Metadata