ClawHub
Back to skill

Security audit

cursor-agent

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Cursor CLI guide, but it includes unsafe installation and automation steps that deserve review before use.

Install only after reviewing the installer path and automation workflow. Prefer a package-managed or verified Cursor CLI install, do not pipe remote scripts directly into a shell, do not auto-trust unknown workspaces, and avoid `--force` except in isolated repositories with version control and reviewed scope.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:16
Finding

Remote Installer Executed Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:28
Finding

Quick Start Executes a Mutable Remote Installer Directly in Bash

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:198
Finding

Automation Unconditionally Accepts Workspace Trust

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (9)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The command fetches an external script from the internet and executes it in a shell in a single step. This creates a direct remote code execution path for anyone following the documentation, making compromise of the distribution endpoint or content highly impactful.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

Install the Cursor CLI:

bash
# Standard installation (macOS, Linux, WSL)
curl https://cursor.com/install -fsS | bash

# Homebrew (macOS only)
brew install --cask cursor-cli

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The pipe into bash is the risky chaining behavior because it removes any opportunity for the user or tooling to review the downloaded content before execution. In a developer-focused skill, this is especially dangerous because users may copy-paste commands with elevated trust and potentially broad local access.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

Install the Cursor CLI:

bash
# Standard installation (macOS, Linux, WSL)
curl https://cursor.com/install -fsS | bash

# Homebrew (macOS only)
brew install --cask cursor-cli

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

curl https://cursor.com/install -fsS | bash fetches remote content and executes it immediately without verification, which is a well-known supply-chain risk. If the server, transport, or distribution path is compromised, arbitrary code runs on the user's machine instantly.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

Standard Installation (macOS, Linux, Windows WSL)

bash
curl https://cursor.com/install -fsS | bash

Homebrew (macOS only)

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The | bash chaining pattern directly executes downloaded data as shell code, eliminating opportunities for inspection or integrity checks. In a skill that may be used by automation-oriented users, this pattern is particularly dangerous because it normalizes unsafe command execution habits.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

Standard Installation (macOS, Linux, Windows WSL)

bash
curl https://cursor.com/install -fsS | bash

Homebrew (macOS only)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The tmux automation instructs users to send a to trust the workspace automatically, bypassing an important security gate. Workspace trust controls are intended to prevent execution or elevated access in untrusted repositories, so auto-acceptance can expose users to malicious project configuration, scripts, or tool behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to pipe a remote script directly into bash, which executes network-fetched code without inspection, signature verification, or integrity checks. If the remote host, transport, or served script is compromised, users could run arbitrary code on their machines immediately.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
84% confidence
Finding

Describing auto-apply behavior 'without confirmation' encourages autonomous modification of code and files without a review checkpoint. In an agent skill focused on software engineering automation, this is especially risky because prompts can trigger broad changes that may introduce vulnerabilities or damage the workspace.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

agent -p 'Run tests' --output-format stream-json --stream-partial-output

text

**Force mode (auto-apply changes without confirmation):**

```bash
agent -p 'Fix all linting errors' --force

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation recommends --force to auto-apply changes without confirmation but does not warn that this can modify files without human review. In automation or CI contexts, this increases the chance of unsafe, destructive, or security-relevant changes being applied silently.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

bash
# 1. Install tmux if not available
sudo apt install tmux  # Ubuntu/Debian
brew install tmux      # macOS

# 2. Create a tmux session

Static analysis

No suspicious patterns detected.