ClawHub
Back to skill

Security audit

Cursor CLI Headless

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent, but it should be reviewed because it recommends an unsafe remote installer and runs a headless coding agent with file writes enabled by default.

Install only if you are comfortable letting a headless Cursor agent read and modify the selected project. Prefer Cursor's official installation documentation or a verified package instead of running the curl-pipe-to-bash command, keep a clean git state or use a disposable checkout, pass --no-force when you want review-only behavior, limit -d to the intended repository, and avoid prompt files from untrusted sources.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:12
Finding

Unverified Remote Installer Piped Directly to Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:12
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Complete Code Snippet:

markdown
- **Cursor CLI installed**: Run `agent --version`. If missing, install: `curl https://cursor.com/install -fsS | bash` (macOS/Linux/WSL) or see [Installation](https://cursor.com/docs/cli/installation).

Technical Analysis

The prerequisite documentation instructs users to retrieve a mutable script from an external URL and pipe it directly into Bash. The downloaded content is executed immediately without version pinning, cryptographic signature verification, checksum validation, or an opportunity for local inspection.

Although HTTPS provides transport protection, it does not establish that the retrieved script is safe. A compromised distribution endpoint, publisher infrastructure, certificate authority, DNS path, or authorized upstream deployment could alter the effective payload after this Skill has been reviewed.

Executing the remote installer is not required by the wrapper itself. The wrapper only requires an existing Cursor CLI installation. Therefore, prescribing immediate execution of mutable remote code exceeds the minimum safe behavior needed to explain that prerequisite.

Attack Path

  1. A user follows the installation instruction in SKILL.md.
  2. The shell requests the current response from https://cursor.com/install.
  3. The external endpoint or its delivery chain serves modified shell code.
  4. Bash executes that response immediately, without integrity or authenticity verification at the artifact level.
  5. The payload performs arbitrary actions under the privileges of the user running the command.

Impact Assessment

A malicious installer could obtain the full privileges of the invoking account. Depending on that account’s permissions, it could read or modify source code and user files, access environment variables and credentials available to the ...[truncated 294 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the pipe-to-shell command from the prerequisite documentation.
  2. Link to the official installation documentation without embedding an immediately executable remote command.
  3. Prefer an official package manager or a version-pinned release artifact.
  4. If a standalone installer is necessary:
    • Download it to a local file first.
    • Pin the expected version and source.
    • Verify a publisher signature or a trusted, pinned SHA-256 digest.
    • Allow the user to inspect the script.
    • Execute it only after successful verification and explicit consent.
  5. Avoid recommending elevated execution such as sudo unless a documented installation step strictly requires it.
  6. Replace the corresponding error text in scripts/run-task.sh:45 with a safe documentation URL so the insecure command is not propagated to users.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install software by piping a remote script directly into bash via curl. This is dangerous because it executes unverified code from the network immediately, exposing users to supply-chain compromise, man-in-the-middle risks, or malicious changes on the remote host; in the context of a shell-capable automation skill, that risk is especially acute because users are already being guided toward command execution.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
## Prerequisites

- **Cursor CLI installed**: Run `agent --version`. If missing, install: `curl https://cursor.com/install -fsS | bash` (macOS/Linux/WSL) or see [Installation](https://cursor.com/docs/cli/installation).
- **Authenticated**: Set `CURSOR_API_KEY` in the environment for scripts, or run `agent login` interactively once. Check if already logged in with `agent status` or `agent whoami`.

## Quick start

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/run-task.sh (reported line 45)May include surrounding context.

sh
# Check agent is available
if ! command -v agent &>/dev/null; then
  echo "Error: 'agent' (Cursor CLI) not found on PATH. Install: curl https://cursor.com/install -fsS | bash" >&2
  exit 1
fi

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill describes shell-based execution and automation via wrapper scripts, but it does not declare any explicit tool scope such as permissions or allowed-tools. In a skill that delegates code-writing and batch processing to a headless agent, missing scope boundaries increases the risk of overbroad shell access and unclear execution limits, which can enable unintended command execution or file modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script enables destructive behavior by default via FORCE=true and documents --force as the default, so invoking the wrapper without noticing this behavior can allow the downstream agent to modify files immediately. In a headless coding-agent skill, that increases the chance of unintended or prompt-driven code changes to the working directory, especially when prompts come from files or automation rather than an interactive user review step.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This markdown file documents a writeToolCall that writes content to a specified path and reports the created file details, but it does not include any warning or disclosure that using this capability will modify local files. Under the markdown-specific warning criterion, behaviors affecting user data or system state should be disclosed clearly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The example NDJSON flow demonstrates creating summary.txt via writeToolCall and confirming completion, but the surrounding documentation does not warn that this behavior changes the filesystem. For markdown skill documentation, examples that perform writes should be accompanied by a user-facing warning about potential data impact.

Content

No source excerpt is available for this finding.