cursor-figure-it-out
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official GitHub repository for Cursor plugins (
github.com/cursor/plugins.git) in its documentation for source tracking and updates. This link targets a well-known service and is used for legitimate attribution. - [INDIRECT_PROMPT_INJECTION]: The skill acts as a general-purpose task framing engine, creating a surface where malicious instructions could be embedded in user-supplied task descriptions.
- Ingestion points: User-provided task descriptions or migration goals processed at runtime (SKILL.md).
- Boundary markers: Absent; there are no specific markers or instructions to ignore embedded commands within the processed task data.
- Capability inventory: The skill coordinates other tools like
cursor-architectandcursor-show-me-your-work, which provide the capabilities to execute logic or modify files based on the designed workflow. - Sanitization: Absent; the instructions do not include any steps for sanitizing or escaping the content of the task description.
Audit Metadata