windsurf-extension-pack
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill is configured with
Bash(cmd:*)permissions to facilitate the automated installation and setup of IDE extensions. This broad tool access is consistent with the primary purpose of managing a development environment. - [INDIRECT_PROMPT_INJECTION]: The skill ingests project-specific requirements and team standards to generate recommended configurations, creating a minor surface for indirect injection.
- Ingestion points: Assessment of project languages and team requirements mentioned in
SKILL.mdandimplementation.md. - Boundary markers: Instructions do not explicitly define delimiters for external project data.
- Capability inventory: The skill utilizes
Read,Write, andBashtools for file system and environment management. - Sanitization: Output is directed into structured JSON formats (
settings.json,extensions.json), providing implicit schema validation.
Audit Metadata