project-editor-profile
Warn
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the setup of automatic script execution. Evidence: It generates a
.cursor/hooks.jsonfile designed to trigger the execution ofscripts/load-workspace-plugins.mjswhenever the workspace is opened. Evidence: It instructs the user to execute local scripts likescripts/sync-editor-profile.mjsto maintain project settings. - [PROMPT_INJECTION]: The skill processes project manifest files to generate configuration, creating a surface for indirect injection. Ingestion point: The
.editor/profile.jsonfile is used as the source for generating settings and hooks. Boundary markers: No specific delimiters are provided to distinguish between manifest data and generation instructions. Capability inventory: The skill can modify sensitive IDE settings and register automated shell hooks. Sanitization: No sanitization or validation of the input JSON manifest is described. - [SAFE]: The skill includes links to official documentation from trusted sources including Microsoft (VS Code), Cursor, and Biome.
Audit Metadata