The Agent Skills Directory

[DATA_EXPOSURE]: The skill includes a worktree audit script (scripts/worktree-audit.sh) that accesses sensitive user data in the form of AI agent transcripts stored at ~/.cursor/projects/*/agent-transcripts. This access is used for the legitimate purpose of identifying which worktrees are currently in use by active chat sessions to prevent accidental deletion during disk cleanup.
[INDIRECT_PROMPT_INJECTION]: The scripts/check-upstream.sh script fetches git logs and diffs from an external repository (https://github.com/cursor/plugins.git) and incorporates this data into a prompt for the AI to review. This creates an attack surface where a compromise of the upstream repository could allow an attacker to inject malicious instructions into the agent's context through commit messages or file contents.
Ingestion points: Git log and diff output from the upstream repository are read by scripts/check-upstream.sh and used to generate a review prompt.
Boundary markers: The generated prompt uses markdown headers but lacks explicit instructions to ignore potentially malicious embedded content within the git data.
Capability inventory: The skill has capabilities to read/write files and execute shell commands across several playbooks.
Sanitization: The script performs string interpolation but does not sanitize the content of the external git data for potential prompt injection patterns.
[EXTERNAL_DOWNLOADS]: The skill fetches metadata and code updates from a remote repository at https://github.com/cursor/plugins.git via the scripts/check-upstream.sh script. This target is a well-known service and organization, and the operation is used for maintenance purposes.

pstack-skill