cursor-continual-learning
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze external conversation transcripts to extract 'durable candidate rules' for future tasks. This creates a surface for indirect prompt injection, where malicious instructions hidden in a transcript could potentially be adopted as long-term agent rules.
- Ingestion points: The workflow relies on reading 'supplied task history' or 'transcripts' provided by the user or an automated process (SKILL.md).
- Boundary markers: The skill explicitly instructs the agent to 'Verify the transcript is explicitly authorized' and 'exclude secrets and unrelated private conversations' (SKILL.md).
- Capability inventory: While the workflow mentions updating
AGENTS.md(file-write access), it includes a mandatory human-in-the-loop check: 'Do not edit AGENTS.md... unless the user separately authorizes that exact write' (SKILL.md). - Sanitization: The agent is instructed to cite source lines, deduplicate rules, and distinguish between temporary task wording and user authority to minimize the risk of adopting improper rules.
Audit Metadata