Coding with Cursor AI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:49 AM UTC
• Version: 1.0.0

Overview

This is a coherent Cursor coding-agent wrapper, but it gives a third-party agent full repository edit and commit authority with weak scoping and supply-chain/temp-file hardening gaps.

Review this skill before installing. Use it only on feature branches or disposable working copies, verify all changes before committing or merging, avoid running it with unrelated secrets in the environment, and prefer a pinned, reviewed cursor-agent version plus safer temporary-file handling.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/coding-with-cursor-ai.sh:53

Finding

Predictable Temporary File Enables Symlink-Based File Overwrite

Content

View full analysis

Vulnerability Details

File Location: scripts/coding-with-cursor-ai.sh, lines 53-54
Vulnerability Type: Predictable and insecure temporary-file creation
Risk Level: Medium

Vulnerable Code

bash

TASK_FILE="/tmp/cursor-task-$(date +%s).txt"
echo "# Task Request" > "$TASK_FILE"

Technical Analysis

The script constructs a temporary filename using only the current Unix timestamp and writes to it using shell redirection. This filename is predictable and is not created atomically.

On a multi-user system, a local attacker can predict the filename and create a symbolic link at that location before the script opens it. Shell redirection follows symbolic links, so the script can overwrite the linked destination if the account running the skill has permission to modify that destination.

The script also does not set a restrictive umask, so the confidentiality of task data depends on the invoking process's existing permission configuration.

Attack Path

1. A local attacker determines when the script will execute or repeatedly predicts filenames based on the current timestamp.
2. The attacker creates /tmp/cursor-task-<timestamp>.txt as a symbolic link to a target file.
3. A user, automated service, or privileged account runs the skill during the corresponding second.
4. The first and subsequent output redirections follow the attacker's symbolic link.
5. The target file is overwritten with task-file content, subject to the invoking account's filesystem permissions.

Impact Assessment

Successful exploitation permits modification or corruption of files writable by the account invoking the script. If the skill runs under a privileged or service account, the overwrite scope expands to files writable by that account and could potentially alter security-sensitive configuration or application state.

The predictable path may also expose project paths, task descriptions, and focused filenam ...[truncated 81 chars]

Remediation

View remediation

Remediation Suggestions

Create the temporary file atomically with mktemp, apply restrictive permissions, and reject creation failures:

bash

umask 077
TASK_FILE="$(mktemp /tmp/cursor-task.XXXXXX)" || {
  echo "Error: Unable to create temporary task file." >&2
  exit 1
}
trap 'rm -f -- "$TASK_FILE"' EXIT

Additional hardening should include:

• Keep the temporary file owned and readable only by the invoking user.
• Do not construct temporary paths from timestamps, process IDs, or other predictable values.
• Quote the filename for every operation.
• Prefer a private runtime directory when one is available.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/coding-with-cursor-ai.sh:98

Finding

Temporary Task Data Persists When Agent Execution Fails

Content

View full analysis

Vulnerability Details

File Location: scripts/coding-with-cursor-ai.sh, lines 4, 53-54, and 98-102
Vulnerability Type: Incomplete cleanup of sensitive temporary data
Risk Level: Low

Vulnerable Code

bash

# Exit on any error
set -e

# Create a temporary task file for Cursor
TASK_FILE="/tmp/cursor-task-$(date +%s).txt"
echo "# Task Request" > "$TASK_FILE"

cursor-agent --task-file "$TASK_FILE" --project-root "$PROJECT_PATH"

# Cleanup
echo ""
echo "Task completed. Cleaning up temporary files..."
rm -f "$TASK_FILE"

Technical Analysis

Cleanup is performed only after cursor-agent exits successfully. Because set -e terminates the script when a command fails, a nonzero exit from cursor-agent, or another error after task-file creation, prevents execution from reaching rm -f.

The residual file contains the project path, complete natural-language task, optional file list, and generated instructions. It is placed in the shared /tmp directory, and the script does not explicitly enforce owner-only permissions.

Attack Path

1. The script creates and populates the task file in /tmp.
2. cursor-agent fails, is interrupted, or returns a nonzero exit status.
3. set -e terminates the script before the explicit rm -f command.
4. The predictable task file remains on disk.
5. A local user locates the residual file and reads its contents if filesystem permissions permit access.

An attacker able to influence agent availability or execution may intentionally trigger the failure, but accidental failures are also sufficient to leave the file behind.

Impact Assessment

The primary impact is local information disclosure. Exposed data can include repository locations, development plans, bug descriptions, feature details, and names of security-sensitive files. The issue does not by itself grant repository modification rights or disclose CURSOR_API_KEY, because the API key i ...[truncated 33 chars]

Remediation

View remediation

Remediation Suggestions

Register cleanup immediately after securely creating the temporary file so that it runs on successful completion, command failure, interruption, or early exit:

bash

umask 077
TASK_FILE="$(mktemp /tmp/cursor-task.XXXXXX)"
trap 'rm -f -- "$TASK_FILE"' EXIT HUP INT TERM

The script should also:

• Use owner-only file permissions.
• Avoid placing sensitive task data in a predictable path.
• Minimize the information written to disk.
• Consider passing task content through a protected standard-input channel if supported by cursor-agent.

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Executable Third-Party Dependency Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, line 1
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

text

cursor-agent

Technical Analysis

The dependency is declared without a fixed version or integrity hash. Consequently, separate installations may resolve to different releases, including a newly compromised, malicious, or otherwise unsafe package version.

This dependency is especially security-sensitive because scripts/coding-with-cursor-ai.sh executes its cursor-agent command with access to the selected project directory and the invoking process's environment. The script also deliberately exports CURSOR_API_KEY when present.

The audit found no evidence that the currently referenced dependency is malicious. The vulnerability is the absence of version and integrity controls around code that receives substantial repository and environment access.

Attack Path

1. An attacker compromises the package distribution channel, maintainer account, or a future package release.
2. A user installs dependencies from the unpinned requirements.txt.
3. The installer resolves cursor-agent to the attacker-controlled or compromised release.
4. The skill invokes the installed cursor-agent executable.
5. Malicious package code executes with the invoking user's permissions and can access the selected repository and inherited environment.

Impact Assessment

A compromised dependency could read, modify, or delete files accessible to the invoking account, tamper with the target repository, extract the exported CURSOR_API_KEY, or misuse other inherited credentials. The exact scope is bounded by the operating-system privileges, filesystem access, environment, and network access granted to the process.

Remediation

View remediation

Remediation Suggestions

Pin the dependency to a reviewed version and verify its package integrity. For example:

text

cursor-agent==<reviewed-version> --hash=sha256:<verified-package-hash>

Security hardening should also include:

• Install with hash enforcement, such as pip install --require-hashes -r requirements.txt, when compatible with the package format.
• Verify and document the authoritative package name and distribution source.
• Use a lockfile or reproducible dependency-generation process.
• Review package updates before changing the pin.
• Run the agent with the minimum required filesystem and environment access.
• Avoid inheriting unrelated credentials into the agent process.
• Restrict network access where it is not required.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The usage guidance is broad enough to route many ordinary software-development requests to a high-privilege coding agent that can modify repositories and commit changes. That increases the chance of unnecessary invocation, prompt-injection exposure through untrusted project content, and accidental code changes beyond the minimum needed scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that it will 'complete the task and commit changes' but does not prominently warn users up front that invocation can result in automatic repository modifications and commits. In a coding context with full repository access, this is dangerous because users may trigger the skill expecting analysis or drafting assistance, while the agent performs persistent changes that can introduce malicious or defective code into version control.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified without a version pin, so installations may resolve to different releases over time, including buggy or malicious upstream versions. This weakens reproducibility and increases supply-chain risk, especially for an agent-related package that may have broad local access when installed or executed.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

cursor-agent