Cursor CLI Headless

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:38 PM UTC
• Version: 1.1.0

Overview

The skill is coherent, but it should be reviewed because it recommends an unsafe remote installer and runs a headless coding agent with file writes enabled by default.

Install only if you are comfortable letting a headless Cursor agent read and modify the selected project. Prefer Cursor's official installation documentation or a verified package instead of running the curl-pipe-to-bash command, keep a clean git state or use a disposable checkout, pass --no-force when you want review-only behavior, limit -d to the intended repository, and avoid prompt files from untrusted sources.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:12
• Finding: Unverified Remote Installer Piped Directly to Bash## Vulnerability Details **File Location**: `SKILL.md:12` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Complete Code Snippet**: ```markdown - **Cursor CLI installed**: Run `agent --version`. If missing, install: `curl https://cursor.com/install -fsS | bash` (macOS/Linux/WSL) or see [Installation](https://cursor.com/docs/cli/installation). ``` ### Technical Analysis The prerequisite documentation instructs users to retrieve a mutable script from an external URL and pipe it directly into Bash. The downloaded content is executed immediately without version pinning, cryptographic signature verification, checksum validation, or an opportunity for local inspection. Although HTTPS provides transport protection, it does not establish that the retrieved script is safe. A compromised distribution endpoint, publisher infrastructure, certificate authority, DNS path, or authorized upstream deployment could alter the effective payload after this Skill has been reviewed. Executing the remote installer is not required by the wrapper itself. The wrapper only requires an existing Cursor CLI installation. Therefore, prescribing immediate execution of mutable remote code exceeds the minimum safe behavior needed to explain that prerequisite. ### Attack Path 1. A user follows the installation instruction in `SKILL.md`. 2. The shell requests the current response from `https://cursor.com/install`. 3. The external endpoint or its delivery chain serves modified shell code. 4. Bash executes that response immediately, without integrity or authenticity verification at the artifact level. 5. The payload performs arbitrary actions under the privileges of the user running the command. ### Impact Assessment A malicious installer could obtain the full privileges of the invoking account. Depending on that account’s permissions, it could read or modify source code and user files, access environment variables and credentials available to the ...[truncated 294 chars]
• Remediation: ## Remediation Suggestions 1. Remove the pipe-to-shell command from the prerequisite documentation. 2. Link to the official installation documentation without embedding an immediately executable remote command. 3. Prefer an official package manager or a version-pinned release artifact. 4. If a standalone installer is necessary: - Download it to a local file first. - Pin the expected version and source. - Verify a publisher signature or a trusted, pinned SHA-256 digest. - Allow the user to inspect the script. - Execute it only after successful verification and explicit consent. 5. Avoid recommending elevated execution such as `sudo` unless a documented installation step strictly requires it. 6. Replace the corresponding error text in `scripts/run-task.sh:45` with a safe documentation URL so the insecure command is not propagated to users.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

External Script Fetching

High

• Category: Supply Chain

Content

## Prerequisites

- **Cursor CLI installed**: Run `agent --version`. If missing, install: `curl https://cursor.com/install -fsS | bash` (macOS/Linux/WSL) or see [Installation](https://cursor.com/docs/cli/installation).
- **Authenticated**: Set `CURSOR_API_KEY` in the environment for scripts, or run `agent login` interactively once. Check if already logged in with `agent status` or `agent whoami`.

## Quick start

• Confidence: 98% confidence
• Finding: The skill instructs users to install software by piping a remote script directly into bash via curl. This is dangerous because it executes unverified code from the network immediately, exposing users to supply-chain compromise, man-in-the-middle risks, or malicious changes on the remote host; in the context of a shell-capable automation skill, that risk is especially acute because users are already being guided toward command execution.

External Script Fetching

High

• Category: Supply Chain

Content

# Check agent is available
if ! command -v agent &>/dev/null; then
  echo "Error: 'agent' (Cursor CLI) not found on PATH. Install: curl https://cursor.com/install -fsS | bash" >&2
  exit 1
fi

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill describes shell-based execution and automation via wrapper scripts, but it does not declare any explicit tool scope such as permissions or allowed-tools. In a skill that delegates code-writing and batch processing to a headless agent, missing scope boundaries increases the risk of overbroad shell access and unclear execution limits, which can enable unintended command execution or file modification.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script enables destructive behavior by default via FORCE=true and documents --force as the default, so invoking the wrapper without noticing this behavior can allow the downstream agent to modify files immediately. In a headless coding-agent skill, that increases the chance of unintended or prompt-driven code changes to the working directory, especially when prompts come from files or automation rather than an interactive user review step.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This markdown file documents a `writeToolCall` that writes content to a specified path and reports the created file details, but it does not include any warning or disclosure that using this capability will modify local files. Under the markdown-specific warning criterion, behaviors affecting user data or system state should be disclosed clearly.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: The example NDJSON flow demonstrates creating `summary.txt` via `writeToolCall` and confirming completion, but the surrounding documentation does not warn that this behavior changes the filesystem. For markdown skill documentation, examples that perform writes should be accompanied by a user-facing warning about potential data impact.