Rank#1842
    cursorskills.shWorkflow848Last updated Aug 17, 2026, 02:54 PMskills.sh/cursor/plugins/reproduce-and-fix-issues

    Security Findings

    Flagged by Snyk on skills.sh (warn · medium)

    SuspiciousLineage

    W011 Third-party content exposure detected (indirect prompt injection risk). — Third-party content exposure detected (high risk: 0.85). The workflow reads the full source thread and tracker issue (outsider-authored Slack messages and GitHub issue text) and uses that readable prose in the agent’s context during “Study the report” (steps 6 and 9), creating an indirect prompt-injection risk.

    Versions

    1
    • Scanned Aug 17, 2026, 02:54 PMLow