workflow-from-chats
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted chat history to generate new rules and skills.
- Ingestion points: Recent Cursor chat history and subagent transcripts are read into the agent's context (SKILL.md).
- Boundary markers: Boundary markers are absent; no specific delimiters or 'ignore' instructions are provided for the ingested chat data.
- Capability inventory: Across all instructions, the skill involves file-write operations to create new artifacts such as skills, rules, and workflow documents (SKILL.md).
- Sanitization: Sanitization is absent; the workflow includes a filtering step for relevance but does not explicitly sanitize against adversarial instructions hidden in the chat data.
- [SAFE]: The skill references source material from a well-known AI development tool's public GitHub repository (github.com/cursor/plugins).
Audit Metadata