{
  "capability_id": "devin-cursorrules",
  "capability_type": "skill",
  "status": "FINDINGS",
  "methodology_version": "1.0",
  "categories_tested": [
    "prompt_injection_chains",
    "privilege_escalation",
    "data_exfiltration_side_channels",
    "capability_squatting",
    "context_poisoning",
    "dependency_confusion"
  ],
  "test_counts": {
    "patterns_analyzed": 29
  },
  "findings": [
    {
      "id": "ADV-2026-0001",
      "category": "prompt_injection_chains",
      "capability_tested": "devin-cursorrules",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "high",
      "classification": "warn",
      "status": "confirmed",
      "summary": "Tool parameter injection vulnerabilities in web scraping and search functions",
      "description": "The skill contains multiple tools that accept user-provided URLs and search queries without proper sanitization. The web_scraper.py tool accepts URLs directly from command line arguments and passes them to Playwright's page.goto() method. The search_engine.py tool accepts search queries that are passed directly to the DuckDuckGo API. While these don't enable direct shell injection, they create attack surfaces where malicious URLs could potentially exploit browser vulnerabilities or where crafted search queries could manipulate API behavior.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "From web_scraper.py: 'await page.goto(url)' where url comes from 'parser.add_argument('urls', nargs='+', help='URLs to process')'. From search_engine.py: 'results = list(ddgs.text(query, max_results=max_results))' where query comes from 'parser.add_argument(\"query\", help=\"Search query\")'",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The skill contains multiple tools that accept user-provided URLs and search queries without proper sanitization. The web_scraper.py tool accepts URLs directly from command line arguments and passes them to Playwright's page.goto() method. The search_engine.py tool accepts search queries that are passed directly to the DuckDuckGo API. While these don't enable direct shell injection, they create attack surfaces where malicious URLs could potentially exploit browser vulnerabilities or where crafted search queries could manipulate API behavior.",
      "recommendation": "Implement URL validation beyond basic format checking (validate schemes, block localhost/private IPs, implement allowlists). Add input sanitization for search queries to prevent potential API manipulation. Consider implementing rate limiting and request size limits.",
      "tested_at": "2026-04-01T03:45:56.407Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    },
    {
      "id": "ADV-2026-0002",
      "category": "prompt_injection_chains",
      "capability_tested": "devin-cursorrules",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "high",
      "classification": "review",
      "status": "suspected",
      "summary": "LLM API tool accepts arbitrary prompts without instruction boundaries",
      "description": "The llm_api.py tool accepts user-provided prompts and passes them directly to various LLM providers without establishing clear boundaries between the tool's intended function and user content. While the tool itself doesn't contain skill instructions that could be overridden, it creates a pathway for users to send arbitrary instructions to LLMs, potentially bypassing intended usage patterns when integrated into larger systems.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "From llm_api.py: 'parser.add_argument('--prompt', type=str, help='The prompt to send to the LLM', required=True)' and 'messages = [{\"role\": \"user\", \"content\": []}]' followed by 'messages[0][\"content\"].append({\"type\": \"text\", \"text\": prompt})'",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The llm_api.py tool accepts user-provided prompts and passes them directly to various LLM providers without establishing clear boundaries between the tool's intended function and user content. While the tool itself doesn't contain skill instructions that could be overridden, it creates a pathway for users to send arbitrary instructions to LLMs, potentially bypassing intended usage patterns when integrated into larger systems.",
      "recommendation": "Add explicit framing around user prompts to establish them as data rather than instructions. Consider implementing prompt templates that clearly delineate user content from system instructions. Add content filtering for obvious instruction injection attempts.",
      "tested_at": "2026-04-01T03:45:56.407Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    },
    {
      "id": "ADV-2026-0003",
      "category": "privilege_escalation",
      "capability_tested": "devin-cursorrules",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "medium",
      "classification": "review",
      "status": "confirmed",
      "summary": "Skill uses undeclared web browsing and search capabilities through tool scripts",
      "description": "The skill declares web_browsing and search_engine_access as dependencies, but the actual tool implementations (screenshot_utils.py, search_engine.py, web_scraper.py) provide capabilities that go beyond basic browsing and searching. The web scraper can fetch arbitrary URLs with concurrent processing, the screenshot tool can capture any webpage, and the search tool provides DuckDuckGo integration. While these are declared as dependencies, the implementations are more powerful than typical agent capabilities.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "Dependencies declare 'web_browsing' and 'search_engine_access' but tools implement: async def take_screenshot(url: str, output_path: str = None, width: int = 1280, height: int = 720), def search_with_retry(query, max_results=10, max_retries=3), async def process_urls(urls: List[str], max_concurrent: int = 5)",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The skill declares web_browsing and search_engine_access as dependencies, but the actual tool implementations (screenshot_utils.py, search_engine.py, web_scraper.py) provide capabilities that go beyond basic browsing and searching. The web scraper can fetch arbitrary URLs with concurrent processing, the screenshot tool can capture any webpage, and the search tool provides DuckDuckGo integration. While these are declared as dependencies, the implementations are more powerful than typical agent capabilities.",
      "recommendation": "Consider declaring more specific capability requirements that match the actual tool implementations, or restrict the tools to basic functionality that aligns with standard agent capabilities.",
      "tested_at": "2026-04-01T03:45:56.407Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    },
    {
      "id": "ADV-2026-0004",
      "category": "privilege_escalation",
      "capability_tested": "devin-cursorrules",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "high",
      "classification": "review",
      "status": "suspected",
      "summary": "Environment loading function accesses system-wide configuration files",
      "description": "The load_environment() function searches for and loads environment variables from multiple .env files in order of precedence (.env.local, .env, .env.example). While this is contained within the project directory, the function prints all available system environment variables to stderr for debugging, which could expose sensitive system-level configuration.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "print(\"Available system environment variables:\", list(os.environ.keys()), file=sys.stderr) and env_files = ['.env.local', '.env', '.env.example']",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The load_environment() function searches for and loads environment variables from multiple .env files in order of precedence (.env.local, .env, .env.example). While this is contained within the project directory, the function prints all available system environment variables to stderr for debugging, which could expose sensitive system-level configuration.",
      "recommendation": "Remove the debug output of system environment variables, or filter it to only show relevant variables. Consider limiting environment file loading to a single standard file to reduce complexity.",
      "tested_at": "2026-04-01T03:45:56.407Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    },
    {
      "id": "ADV-2026-0005",
      "category": "data_exfiltration_side_channels",
      "capability_tested": "devin-cursorrules",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "medium",
      "classification": "review",
      "status": "confirmed",
      "summary": "Extensive debug logging exposes sensitive data including API keys and environment variables",
      "description": "The skill contains multiple instances of debug logging that expose sensitive information. The load_environment() function prints all environment variable keys to stderr, which could reveal the presence of API keys. The llm_api.py module logs loaded environment variable keys from .env files. The search_engine.py and web_scraper.py modules use extensive debug logging that could expose query parameters and URLs containing sensitive data.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "print(\"Available system environment variables:\", list(os.environ.keys()), file=sys.stderr)\nprint(f\"Keys loaded from {env_file}: {keys}\", file=sys.stderr)\nprint(f\"DEBUG: Searching for query: {query} (attempt {attempt + 1}/{max_retries})\", file=sys.stderr)\nlogger.info(f\"Fetching {url}\")",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The skill contains multiple instances of debug logging that expose sensitive information. The load_environment() function prints all environment variable keys to stderr, which could reveal the presence of API keys. The llm_api.py module logs loaded environment variable keys from .env files. The search_engine.py and web_scraper.py modules use extensive debug logging that could expose query parameters and URLs containing sensitive data.",
      "recommendation": "Remove or sanitize debug logging that exposes environment variable names, API endpoints, and query parameters. Implement proper log levels and ensure sensitive data is never logged even in debug mode.",
      "tested_at": "2026-04-01T03:45:56.407Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    },
    {
      "id": "ADV-2026-0006",
      "category": "data_exfiltration_side_channels",
      "capability_tested": "devin-cursorrules",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "high",
      "classification": "warn",
      "status": "confirmed",
      "summary": "Undocumented external API calls to multiple LLM providers and search services",
      "description": "The skill makes HTTP requests to multiple external services without declaring these network destinations in its metadata. It connects to OpenAI (api.openai.com), Azure OpenAI, DeepSeek (api.deepseek.com), SiliconFlow (api.siliconflow.cn), Anthropic, Google Gemini, DuckDuckGo search, and a hardcoded local IP address (192.168.180.137:8006). These external calls could be used to exfiltrate project data through API requests, search queries, or LLM prompts.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "base_url=\"https://api.openai.com/v1\"\nbase_url=\"https://api.deepseek.com/v1\"\nbase_url=\"https://api.siliconflow.cn/v1\"\nbase_url=\"http://192.168.180.137:8006/v1\"\nwith DDGS() as ddgs:\n    results = list(ddgs.text(query, max_results=max_results))",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The skill makes HTTP requests to multiple external services without declaring these network destinations in its metadata. It connects to OpenAI (api.openai.com), Azure OpenAI, DeepSeek (api.deepseek.com), SiliconFlow (api.siliconflow.cn), Anthropic, Google Gemini, DuckDuckGo search, and a hardcoded local IP address (192.168.180.137:8006). These external calls could be used to exfiltrate project data through API requests, search queries, or LLM prompts.",
      "recommendation": "Declare all external network destinations in the skill metadata. Document the purpose of each external service. Consider implementing user consent for data transmission to third-party APIs.",
      "tested_at": "2026-04-01T03:45:56.407Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    },
    {
      "id": "ADV-2026-0007",
      "category": "data_exfiltration_side_channels",
      "capability_tested": "devin-cursorrules",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "critical",
      "classification": "warn",
      "status": "confirmed",
      "summary": "Credential harvesting through environment variable access and .env file reading",
      "description": "The skill actively reads and processes multiple credential sources including API keys from environment variables and .env files. It accesses OPENAI_API_KEY, AZURE_OPENAI_API_KEY, DEEPSEEK_API_KEY, ANTHROPIC_API_KEY, GOOGLE_API_KEY, and SILICONFLOW_API_KEY. The load_environment() function reads .env.local, .env, and .env.example files and logs their contents. While this appears to be for legitimate API access, the extensive credential harvesting creates a significant attack surface.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "api_key = os.getenv('OPENAI_API_KEY')\napi_key = os.getenv('AZURE_OPENAI_API_KEY')\napi_key = os.getenv('DEEPSEEK_API_KEY')\napi_key = os.getenv('ANTHROPIC_API_KEY')\napi_key = os.getenv('GOOGLE_API_KEY')\napi_key = os.getenv('SILICONFLOW_API_KEY')\nload_dotenv(dotenv_path=env_path)\nwith open(env_path) as f:\n    keys = [line.split('=')[0].strip() for line in f if '=' in line and not line.startswith('#')]",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The skill actively reads and processes multiple credential sources including API keys from environment variables and .env files. It accesses OPENAI_API_KEY, AZURE_OPENAI_API_KEY, DEEPSEEK_API_KEY, ANTHROPIC_API_KEY, GOOGLE_API_KEY, and SILICONFLOW_API_KEY. The load_environment() function reads .env.local, .env, and .env.example files and logs their contents. While this appears to be for legitimate API access, the extensive credential harvesting creates a significant attack surface.",
      "recommendation": "Limit credential access to only the declared LLM providers. Implement proper credential scoping and validation. Remove debug logging of credential file contents. Consider using a more secure credential management approach.",
      "tested_at": "2026-04-01T03:45:56.407Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    },
    {
      "id": "ADV-2026-0008",
      "category": "capability_squatting",
      "capability_tested": "devin-cursorrules",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "high",
      "classification": "review",
      "status": "confirmed",
      "summary": "Skill contains extensive code files beyond declared instruction scope",
      "description": "The skill declares an empty scope ({}) but contains substantial Python code files including LLM API clients, web scraping tools, screenshot utilities, and search engines. This represents a significant volume mismatch between the declared minimal scope and the actual extensive codebase. The skill appears to be a complete development toolkit rather than a simple rules file.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "Declared scope: {} vs. Actual content: Multiple Python files (llm_api.py, screenshot_utils.py, search_engine.py, web_scraper.py) with thousands of lines of code including API clients for OpenAI, Anthropic, Google Gemini, web automation with Playwright, and search functionality",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The skill declares an empty scope ({}) but contains substantial Python code files including LLM API clients, web scraping tools, screenshot utilities, and search engines. This represents a significant volume mismatch between the declared minimal scope and the actual extensive codebase. The skill appears to be a complete development toolkit rather than a simple rules file.",
      "recommendation": "Update the skill metadata to accurately declare the scope and capabilities. The declared scope should reflect that this is a comprehensive development toolkit with LLM API access, web browsing, screenshot capabilities, and search functionality rather than an empty scope.",
      "tested_at": "2026-04-01T03:45:56.407Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    },
    {
      "id": "ADV-2026-0009",
      "category": "context_poisoning",
      "capability_tested": "devin-cursorrules",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "high",
      "classification": "review",
      "status": "suspected",
      "summary": "Skill provides broad LLM API access and web scraping capabilities beyond typical cursor rules scope",
      "description": "This skill appears to be named 'devin.cursorrules' suggesting it's a cursor rules file, but contains extensive Python tooling for LLM API access, web scraping, and screenshot capabilities. The scope includes multiple LLM providers (OpenAI, Anthropic, Google, Azure, DeepSeek, SiliconFlow), web browsing with Playwright, and search engine access. This is significantly broader than typical cursor rules which focus on coding standards and editor behavior.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "Skill name: 'devin.cursorrules' but contains tools for: llm_api.py (OpenAI, Anthropic, Gemini, Azure, DeepSeek, SiliconFlow clients), screenshot_utils.py (Playwright web automation), search_engine.py (DuckDuckGo search), web_scraper.py (concurrent web scraping with HTML parsing)",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "This skill appears to be named 'devin.cursorrules' suggesting it's a cursor rules file, but contains extensive Python tooling for LLM API access, web scraping, and screenshot capabilities. The scope includes multiple LLM providers (OpenAI, Anthropic, Google, Azure, DeepSeek, SiliconFlow), web browsing with Playwright, and search engine access. This is significantly broader than typical cursor rules which focus on coding standards and editor behavior.",
      "recommendation": "If this is intended as a cursor rules file, scope it to coding standards and editor behavior only. If it's a broader development toolkit, rename it appropriately and clearly document its full scope and capabilities.",
      "tested_at": "2026-04-01T03:45:56.407Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    },
    {
      "id": "ADV-2026-0010",
      "category": "dependency_confusion",
      "capability_tested": "devin-cursorrules",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "high",
      "classification": "warn",
      "status": "confirmed",
      "summary": "Undeclared package installation via duckduckgo_search import",
      "description": "The skill uses 'from duckduckgo_search import DDGS' in search_engine.py but does not declare duckduckgo_search as a dependency in its metadata. This creates an implicit dependency that bypasses user review of what packages will be installed.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "from duckduckgo_search import DDGS",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The skill uses 'from duckduckgo_search import DDGS' in search_engine.py but does not declare duckduckgo_search as a dependency in its metadata. This creates an implicit dependency that bypasses user review of what packages will be installed.",
      "recommendation": "Add duckduckgo_search to the skill's declared dependencies list so users can review all packages that will be installed.",
      "tested_at": "2026-04-01T03:45:56.407Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    },
    {
      "id": "ADV-2026-0011",
      "category": "dependency_confusion",
      "capability_tested": "devin-cursorrules",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "high",
      "classification": "warn",
      "status": "confirmed",
      "summary": "Undeclared package installation via html5lib import",
      "description": "The skill uses 'import html5lib' in web_scraper.py but does not declare html5lib as a dependency in its metadata. This creates an implicit dependency that bypasses user review of what packages will be installed.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "import html5lib",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The skill uses 'import html5lib' in web_scraper.py but does not declare html5lib as a dependency in its metadata. This creates an implicit dependency that bypasses user review of what packages will be installed.",
      "recommendation": "Add html5lib to the skill's declared dependencies list so users can review all packages that will be installed.",
      "tested_at": "2026-04-01T03:45:56.407Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    },
    {
      "id": "ADV-2026-0012",
      "category": "dependency_confusion",
      "capability_tested": "devin-cursorrules",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "high",
      "classification": "warn",
      "status": "confirmed",
      "summary": "Undeclared package installation via dotenv import",
      "description": "The skill uses 'from dotenv import load_dotenv' in llm_api.py but does not declare python-dotenv as a dependency in its metadata. This creates an implicit dependency that bypasses user review of what packages will be installed.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "from dotenv import load_dotenv",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The skill uses 'from dotenv import load_dotenv' in llm_api.py but does not declare python-dotenv as a dependency in its metadata. This creates an implicit dependency that bypasses user review of what packages will be installed.",
      "recommendation": "Add python-dotenv to the skill's declared dependencies list so users can review all packages that will be installed.",
      "tested_at": "2026-04-01T03:45:56.407Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    },
    {
      "id": "ADV-2026-0013",
      "category": "dependency_confusion",
      "capability_tested": "devin-cursorrules",
      "capability_version": "latest",
      "capability_type": "skill",
      "severity": "high",
      "classification": "warn",
      "status": "confirmed",
      "summary": "Undeclared package installations via multiple LLM API imports",
      "description": "The skill imports multiple LLM API packages (google.generativeai, openai, anthropic) in llm_api.py but does not declare these as dependencies in its metadata. This creates implicit dependencies that bypass user review of what packages will be installed.",
      "reproduction": {
        "steps": [
          "Analyze skill instructions against adversarial taxonomy"
        ],
        "inputs_used": [],
        "observed_behavior": "import google.generativeai as genai\nfrom openai import OpenAI, AzureOpenAI\nfrom anthropic import Anthropic",
        "expected_behavior": "No adversarial patterns in skill instructions"
      },
      "impact": "The skill imports multiple LLM API packages (google.generativeai, openai, anthropic) in llm_api.py but does not declare these as dependencies in its metadata. This creates implicit dependencies that bypass user review of what packages will be installed.",
      "recommendation": "Add google-generativeai, openai, and anthropic to the skill's declared dependencies list so users can review all packages that will be installed.",
      "tested_at": "2026-04-01T03:45:56.407Z",
      "tested_by": "llm_assisted",
      "added_to_library": false
    }
  ],
  "summary": {
    "patterns_analyzed": 29,
    "categories_tested": [
      "prompt_injection_chains",
      "privilege_escalation",
      "data_exfiltration_side_channels",
      "capability_squatting",
      "context_poisoning",
      "dependency_confusion"
    ],
    "findings_count": 13,
    "findings_by_severity": {
      "critical": 1,
      "high": 10,
      "medium": 2,
      "low": 0,
      "informational": 0
    },
    "findings_by_classification": {
      "block": 0,
      "warn": 7,
      "review": 6,
      "info": 0
    },
    "findings_deduplicated": 0,
    "duration_ms": 70176,
    "api_usage": {
      "total_input_tokens": 62797,
      "total_output_tokens": 3594,
      "calls": 6
    }
  }
}