windsurf-policy-guardrails
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements proactive security measures by defining terminal command allow-lists and deny-lists to prevent the AI agent from executing destructive commands such as 'sudo', 'rm -rf', or unauthorized network operations.
- [SAFE]: Establishes workspace boundaries using '.codeiumignore' and custom rules to protect sensitive assets including environment variables, private keys, and infrastructure state files from unauthorized access.
- [SAFE]: Provides CI/CD integration templates that automate security checks, including scanning pull requests for hardcoded secrets and ensuring AI-generated code meets defined quality and testing standards.
- [SAFE]: Fetches configuration and guidance from official platform documentation at 'docs.windsurf.com'.
- [INDIRECT_PROMPT_INJECTION]: The skill includes a pre-flight workflow that reads git commit messages, creating an indirect prompt injection surface if those messages contain adversarial instructions.
- Ingestion points: The 'safe-cascade.md' workflow instructs the agent to execute 'git log --oneline -3' to gather context.
- Boundary markers: The workflow does not specify delimiters or instructions to ignore embedded commands within the log output.
- Capability inventory: The skill's configuration grants the agent 'Read', 'Write', 'Edit', and 'Bash' capabilities, which could be exploited if an injection occurs.
- Sanitization: There is no validation or filtering applied to the retrieved commit messages before they are processed by the agent.
Audit Metadata