cursor-reproduce-and-fix-issues
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill dynamically invokes a secondary 'control skill' and reads feature maps based on runtime configuration parameters. This dynamic loading from computed paths is an architectural requirement for its extensible adapter system.
- Evidence: Section 5 of SKILL.md specifies that the coordinator must "invoke the skill named by control.skill_name" and read the map at "control.feature_map_path".
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Slack message threads and external bug tracker issues to guide its reproduction and fix logic, representing a potential prompt injection vector.
- Ingestion points: Slack thread coordinates (
SOURCE_THREAD_TS) and tracker URLs captured from triaged markers. - Boundary markers: Implements a strict 'triage contract' that requires specific markers (e.g.,
[benny:bug]) and verifies the author's identity against theslack.triage_identity_user_idconfiguration. - Capability inventory: Possesses significant capabilities including UI automation (clicks, typing, recording), Slack thread posting, code modification, and GitHub pull request creation.
- Sanitization: The skill employs several validation gates, including a 'media reviewer' to confirm evidence and a 'diff review' for secrets and unrelated changes, though it lacks explicit technical sanitization for ingested natural language content before it reaches delegated workers.
Audit Metadata