pstack-sharpen
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [NO_CODE]: The provided files consist entirely of Markdown documentation, a license, and a YAML metadata file. There are no Python scripts, JavaScript files, or shell scripts included that would perform actions on a host system.
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to process user-provided tasks and refine their approach. This involves ingesting untrusted user data, which presents a standard attack surface for indirect prompt injection. However, since the skill does not expose any dangerous tools, file-system write access, or network capabilities, the risk is negligible.
- [EXTERNAL_DOWNLOADS]: The documentation in
UPSTREAM.mdreferences the original source code and maintenance guidelines from the official Cursor plugins repository on GitHub. These references are for provenance and development context only and do not involve the runtime download or execution of remote code.
Audit Metadata