ClawHub
Back to skill

Security audit

cursor-agent-cli

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Cursor Agent CLI helper, but it recommends unsafe installer execution and high-authority agent modes that users should review before installing.

Install only if you intend to use Cursor Agent CLI and are comfortable with a powerful coding agent that can modify files, run in CI, use cloud/background execution, and persist sessions. Avoid the documented pipe-to-shell installer unless you independently verify the official installer, prefer plan/read-only modes first, avoid --force/--yolo/--trust on untrusted code, do not disable sandboxing casually, and keep API keys out of command history and logs.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:31
Finding

Unverified Remote Installer Piped Directly into Shell Interpreters

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (26)

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · EXAMPLES.md (reported line 89)May include surrounding context.

bash
# Use GPT-5 for complex refactoring
agent --model gpt-5.2 "refactor monolith into microservices"

# Use Sonnet-4 for careful analysis
agent --model sonnet-4-thinking "analyze potential race conditions"

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The installation instruction fetches a remote script and pipes it directly into bash, which executes code from the network without prior inspection or integrity verification. If the server, transport, or install endpoint is compromised, users could immediately run attacker-controlled commands on their systems.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

bash
# Install Cursor Agent CLI
curl https://cursor.com/install -fsS | bash

# Verify
agent --version

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The use of '| bash' creates a direct execution chain from untrusted remote content into a shell, removing any pause for validation and making command injection or malicious installer changes immediately effective. In a developer skill README, this is especially dangerous because users may copy-paste the command into privileged environments or CI systems.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

bash
# Install Cursor Agent CLI
curl https://cursor.com/install -fsS | bash

# Verify
agent --version

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The installation instructions fetch and execute a remote script directly from the network using curl|bash and PowerShell iex. This pattern eliminates meaningful inspection and makes users dependent on transport security and the remote host's integrity; if the endpoint, CDN, or connection is compromised, arbitrary code executes immediately.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

bash
# macOS, Linux, WSL
curl https://cursor.com/install -fsS | bash

# Windows PowerShell
irm 'https://cursor.com/install?win32=true' | iex

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The pipe-to-shell construction is a classic command-chaining abuse pattern because untrusted remote content flows directly into an interpreter. In the context of a shell-capable skill for developers, this is especially dangerous because it teaches an unsafe execution habit and can produce immediate host compromise if the fetched script is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

bash
# macOS, Linux, WSL
curl https://cursor.com/install -fsS | bash

# Windows PowerShell
irm 'https://cursor.com/install?win32=true' | iex

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

bash
# Run with specific prompt
agent -p "find and fix performance issues" --model "gpt-5.2"

# Code review
agent -p "review these changes for security issues" --output-format text

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

agent --list-models

Use specific model

agent --model "gpt-5.2" agent --model "sonnet-4" agent --model "sonnet-4-thinking"

text

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The script instructs users to install the agent by piping a remote script directly into bash, which bypasses review and executes network-fetched code immediately. In a developer tooling context, this is especially dangerous because compromise of the distribution endpoint, TLS interception, or a malicious installer would lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · scripts/cursor-agent.sh (reported line 12)May include surrounding context.

sh
# Check if agent is installed
if ! command -v $AGENT_BIN &> /dev/null; then
    echo "❌ Cursor Agent CLI not found!"
    echo "Install: curl https://cursor.com/install -fsS | bash"
    exit 1
fi

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The script recommends installing software via a direct network fetch piped into a shell (curl ... | bash), which is a well-known unsafe pattern because it executes remote content without verification. If the remote server, CDN, DNS path, or TLS trust chain were compromised, a user following the printed instruction could execute attacker-controlled code on their machine.

Content

Scanner excerpt · scripts/test.sh (reported line 20)May include surrounding context.

sh
agent --version
else
    echo "❌ agent command not found"
    echo "Install: curl https://cursor.com/install -fsS | bash"
    exit 1
fi
echo ""

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The example explicitly promotes --force for non-interactive bug fixing without warning that approval gates are bypassed and files may be modified automatically. In a coding-agent skill, this can normalize unsafe automation and lead users or downstream wrappers to run destructive code changes without human review.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
89% confidence
Finding

The phrase 'auto-approved bug fixing' describes autonomous code modification without human approval, which is risky for a tool capable of editing and executing changes. In this skill's context, that behavior is more dangerous because users may assume examples are safe defaults and deploy them in production workflows.

Content

Scanner excerpt · EXAMPLES.md (reported line 23)May include surrounding context.

agent -p "find and fix the memory leak in server.js" --force

text

**Non-interactive, auto-approved bug fixing.**

## Example 3: Code Review

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The CI/CD example combines --trust with repository workspace access in an automated pipeline, but provides no warning about elevated permissions or the risk of acting on untrusted repository content. In this context, the agent may process and act on attacker-controlled code or prompts from pull requests, increasing the chance of unsafe automated behavior or data exposure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · EXAMPLES.md (reported line 105)May include surrounding context.

Example 12: Git Worktree

bash
# Create isolated worktree for feature
agent -w feature-auth --worktree-base main "implement OAuth2 authentication"

# Work continues in ~/.cursor/worktrees/myrepo/feature-auth

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The custom header example embeds a bearer token directly in a command line, which can leak secrets through shell history, process listings, CI logs, and copied documentation. In an agent/CLI integration skill, examples are often copied verbatim, so this materially increases the chance of credential mishandling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The README explicitly advertises a default 'Full access' mode that can modify code, but it does not warn users that running the agent may change local files or that outputs should be reviewed before acceptance. In a terminal-integrated coding agent skill, that omission increases the chance users will invoke destructive or unsafe edits without understanding the consequences.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill exposes shell-execution capability through examples and integration snippets but does not declare an explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, missing scope declarations weakens containment and makes it easier for the skill to be invoked with broader execution powers than users or orchestrators may expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description includes broad triggers like AI coding, code generation, refactoring, and interactive programming sessions, which can match many ordinary requests. Overbroad activation increases the chance this shell-capable skill is selected unnecessarily, exposing users to command execution pathways in contexts where a safer or narrower skill would suffice.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
88% confidence
Finding

The documented auto-approve capability enables the agent to make decisions and execute actions without human review. In a coding-agent skill with shell access, autonomy can turn prompt mistakes, bad model output, or malicious repository instructions into immediate filesystem or command-side effects.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

Advanced Options

Force Mode (Auto-approve)

bash
# Auto-approve all commands

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill prominently documents force mode, yolo mode, sandbox disabling, and approval-bypassing behavior without an equally prominent warning that these settings reduce safeguards and can lead to unreviewed code execution or file modification. In a terminal agent context, this materially increases the risk of destructive or unsafe actions being performed automatically.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The explicit commands agent --force and agent --yolo instruct the tool to auto-approve all commands, removing a key human-in-the-loop safety control. Because this skill is for interactive coding and terminal use, exploitation could lead to arbitrary command execution, mass file edits, or unsafe git operations without review.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

Force Mode (Auto-approve)

bash
# Auto-approve all commands
agent --force "build the feature"
agent --yolo "build the feature"  # Alias

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
87% confidence
Finding

Auto-approving MCP servers reduces scrutiny over external tool integrations that may expand the agent's reach or data access. In practice, this can let the agent attach to additional capabilities or remote services without adequate review, broadening the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

Manage MCP servers

agent mcp

Auto-approve MCP servers

agent --approve-mcps

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The CI examples recommend using --trust in headless automation, which suppresses workspace trust protections in an environment where code may come from pull requests or other less-trusted sources. That creates a realistic path for untrusted repository content to influence a powerful coding agent with reduced safety checks.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
86% confidence
Finding

The example normalizes non-interactive auto-approved operation for code generation tasks. Even if intended for convenience, presenting auto-approval in examples encourages unsafe operational habits and can lead users to run high-impact modifications without inspection.

Content

Scanner excerpt · SKILL.md (reported line 425)May include surrounding context.

$ agent -p "generate comprehensive tests for src/api/*.js" --force

text

Non-interactive, auto-approved test generation.

### Example 3: Code Review in CI

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/cursor-agent.sh (reported line 129)May include surrounding context.

sh
Options (pass after command):
  --model <model>          Specify model (gpt-5, sonnet-4, etc.)
  --force, --yolo          Auto-approve all commands
  --output-format <fmt>    Output format (text, json, stream-json)
  --workspace <path>       Specify workspace directory
  --sandbox <mode>         Sandbox mode (enabled, disabled)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This shell script is a code file, so missing-warning checks apply. The help output advertises --force, --yolo as Auto-approve all commands, but there is no adjacent warning, confirmation, or caution that this may allow potentially impactful actions to run without review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.