Security risk report for @forgecat/cursor_plugins_continual-learning v0.0.7
Source Integrity
Low
Profile is sourced from a legitimate Cursor plugin repository (https://github.com/cursor/plugins/tree/main/continual-learning) with clear attribution and MIT license.
Commit hash and author (Eric Zakariasson) are documented; no evidence of tampering or supply-chain injection.
Agent Intent
Low
Profile describes a legitimate memory-management workflow: reading transcripts, extracting durable preferences/facts, and updating AGENTS.md—no prompt injection, role hijacking, or instruction to hide/leak system prompts.
Guardrails explicitly exclude secrets, private data, and one-off instructions; the design is defensive against poisoning its own outputs.
No instruction to fetch external URLs, install remote payloads, or weaken security defaults; the skill is self-contained and orchestration-focused.
Workflow step 4: 'Pull out only durable, reusable items: recurring user preferences or corrections, stable workspace facts.'
Skill description: 'Keep the parent skill orchestration-only. Do not mine transcripts or edit files in the parent flow.'
Permissions
PRM-003Medium
The profile uses a subagent (agents-memory-updater) with file-write authority over AGENTS.md and a state JSON index, and read access to all agent transcripts under ~/.cursor — broader than a minimal scoped tool.
A Bun-based stop hook (./hooks/generated-cursor-stop-1-bun.sh) is declared but its tool categories are unresolved by the static scanner (permissions/hook-no-tool-match), meaning its actual authority cannot be fully verified.
No high-risk shell or unrestricted filesystem tools are explicitly declared in the normalized tool list, but the combination of subagent delegation, hook execution, and transcript-wide read access represents moderately excessive agency for a 'memory updater' function.
ForgeCat