cursor-arena
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates a multi-step workflow that ingests data from parallel subagents, creating a surface for indirect prompt injection if a subagent produces malicious content.\n
- Ingestion points: Phase B (Fan out) and Phase D (Pick a base) involve reading outputs from multiple candidate agents.\n
- Boundary markers: Instructions require isolated output paths and git worktrees to prevent shared state issues.\n
- Capability inventory: Uses the
collaboration.spawn_agenttool to orchestrate worker and reviewer agents.\n - Sanitization: Phase F (Verify) serves as a validation step for the final synthesized artifact.\n- [COMMAND_EXECUTION]: The skill documentation guides the use of standard development tools for task isolation.\n
- Evidence: References the use of
git worktreeand directory creation in/tmp/for candidate management.\n- [SAFE]: The skill package includes metadata referencing its origin from the official Cursor plugins repository on GitHub, which is a well-known service.
Audit Metadata