windsurf-migration-deep-dive
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses the
!commandsyntax in the SKILL.md file to detect installed editor versions (windsurf,code, andcursor) at load time. These are benign version checks used for environment reporting. - [COMMAND_EXECUTION]: The migration logic employs shell commands such as
cp,mkdir,grep, andwcto transfer rules and configuration files between directories. It also invokes editor CLIs to list and install extensions, which is appropriate for its stated purpose. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from project-specific configuration files, such as
.cursorrules. While these files could contain embedded instructions, their processing is a necessary part of the migration functionality. No automated execution of the content within these rules is performed; they are merely copied to new locations.
Audit Metadata