delegate-to-cursor-sdk
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes external commands via a Python wrapper script (
scripts/delegation_session.py). This script invokes thecursor-delegateCLI using secure, list-based subprocess calls (subprocess.Popen), avoiding shell injection risks. This execution is central to the skill's intended purpose of delegating tasks to the Cursor SDK. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests data from local or remote software repositories to be processed by the AI agent.
- Ingestion points: Target repository files accessed during the 'Intake' and 'Dispatch' phases (specified in
SKILL.md). - Boundary markers: Task instructions are structured using fenced markdown templates (specified in
references/task-direct.mdand others) to delimit instructions. - Capability inventory: The skill can execute the
cursor-delegateCLI via subprocess and perform file operations within its own temporary session directories (scripts/delegation_session.py). - Sanitization: The risk is mitigated by a mandatory human-in-the-loop review process and a detailed security checklist (specified in
references/review-checklist.md) that requires inspection of diffs and verification of results before acceptance.
Audit Metadata