project-editor-profile

Warn

Audited by Gen Agent Trust Hub on Jul 13, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates the setup of automatic script execution. Evidence: It generates a .cursor/hooks.json file designed to trigger the execution of scripts/load-workspace-plugins.mjs whenever the workspace is opened. Evidence: It instructs the user to execute local scripts like scripts/sync-editor-profile.mjs to maintain project settings.
  • [PROMPT_INJECTION]: The skill processes project manifest files to generate configuration, creating a surface for indirect injection. Ingestion point: The .editor/profile.json file is used as the source for generating settings and hooks. Boundary markers: No specific delimiters are provided to distinguish between manifest data and generation instructions. Capability inventory: The skill can modify sensitive IDE settings and register automated shell hooks. Sanitization: No sanitization or validation of the input JSON manifest is described.
  • [SAFE]: The skill includes links to official documentation from trusted sources including Microsoft (VS Code), Cursor, and Biome.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 13, 2026, 08:46 AM
Security Audit — agent-trust-hub — project-editor-profile