add-shader-cursor-trail
Pass
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the user or agent to execute a local Node.js utility,
scripts/verify-cursor-trail.mjs, for validating implementation files. - [INDIRECT_PROMPT_INJECTION]: The
verify-cursor-trail.mjsscript reads file contents from the local filesystem based on command-line arguments, creating a potential surface for reading unauthorized files. - Ingestion points: File paths provided to the
verify-cursor-trail.mjsscript as arguments inSKILL.md. - Boundary markers: Absent; the script does not include explicit warnings to ignore embedded instructions in the files it reads.
- Capability inventory: The script uses
node:fs/promisesto read files and performs regex-based validation. - Sanitization: The script only checks for specific patterns and throws an error on failure without outputting the file content, which significantly reduces the risk of data exposure.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
shaderspackage (e.g.,shaders/react) through a package manager to provide the WebGPU components and shader nodes.
Audit Metadata