Windsurf CLI agent

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:24 PM UTC
• Version: 1.0.0

Overview

This is a mostly coherent Windsurf/Cascade guide, but it documents powerful no-confirmation terminal execution and token-backed MCP setup without enough safety scoping.

Review this skill before installing if you work in sensitive repositories. Keep Cascade in Manual mode by default, avoid Turbo Mode outside disposable or low-risk environments, do not place real tokens directly in copied MCP config, pin and verify MCP packages, use least-privilege short-lived tokens, and disable or regularly review memories for projects containing secrets, customer data, or regulated information.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:314

Finding

Unpinned Third-Party MCP Package Is Executed with Access to a GitHub Token

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:314-322
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

json

{
  "mcpServers": {
    "github": {
      "command": "uvx",
      "args": ["github-mcp"],
      "env": {
        "GITHUB_TOKEN": "your_token_here"
      }
    }
  }
}

Technical Analysis

The example instructs users to execute github-mcp through uvx without pinning an exact package version or integrity hash. It also does not identify a canonical package source or verified publisher. Consequently, the package resolved at execution time may differ from the component originally reviewed.

The resulting MCP process receives GITHUB_TOKEN through its environment. If the package is compromised, substituted, typosquatted, or unexpectedly changed upstream, its initialization code can run with the current user's operating-system privileges and read the token directly from the process environment.

This finding concerns the unsafe dependency configuration shown in the documentation. The audit did not establish that the current upstream package itself is malicious.

Attack Path

1. A user copies the documented MCP configuration into mcp_config.json.
2. The user places a valid GitHub token in the GITHUB_TOKEN environment entry.
3. Windsurf starts the configured MCP server by invoking uvx github-mcp.
4. uvx resolves and executes the unpinned package available from its configured package source.
5. If an attacker controls or compromises the resolved package or its dependency chain, malicious initialization code executes locally.
6. The malicious code reads GITHUB_TOKEN from its environment and may use or disclose it.
7. The code may also perform local actions permitted to the user who launched Windsurf.

Impact Assessment

Successful exploitation can provide arbitrary code execution with the privileges of ...[truncated 371 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the ambiguous package reference with the canonical package name and document its official publisher and source repository.
2. Pin an audited, exact version instead of resolving the latest available release at runtime.
3. Where supported, lock and verify package hashes or signatures before execution.
4. Use a controlled internal package mirror or an approved dependency allowlist.
5. Run the MCP server in an isolated environment with restricted filesystem and network access.
6. Supply a short-lived, narrowly scoped GitHub token rather than a broadly privileged or personal token.
7. Store the token in an appropriate secret manager and avoid committing a real credential to configuration files.
8. Review the package and its transitive dependencies before upgrades, and monitor for unexpected publisher or ownership changes.
9. Apply the same correction to both SKILL.md and its duplicate at Windsurf/SKILL.md.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

Each skill is a folder with a `SKILL.md` file and optional supporting files:

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation presents Turbo Mode as an option that auto-executes all terminal commands without confirmation, but it lacks a strong warning about destructive, privilege-impacting, or exfiltration-capable commands. In an agent skill for autonomous code assistance, encouraging command execution without review materially raises the chance of accidental system damage, data loss, or hostile prompt-to-command abuse.

Content

No source excerpt is available for this finding.

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 335)May include surrounding context.

md

- **@ Mentions**: Trigger MCP tools by @-mentioning in Cascade
- **Enable/Disable**: Toggle MCP servers from the Cascade header
- **Transports**: Supports stdio, Streamable HTTP, and SSE
- **Enterprise**: Team admins can whitelist/blacklist MCP servers

Each MCP tool call costs one prompt credit.

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · Windsurf/SKILL.md (reported line 335)May include surrounding context.

md

- **@ Mentions**: Trigger MCP tools by @-mentioning in Cascade
- **Enable/Disable**: Toggle MCP servers from the Cascade header
- **Transports**: Supports stdio, Streamable HTTP, and SSE
- **Enterprise**: Team admins can whitelist/blacklist MCP servers

Each MCP tool call costs one prompt credit.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file describes 'Turbo Mode' as auto-executing terminal commands without manual confirmation, which is a safety-relevant behavior that could affect system integrity. The surrounding documentation provides no warning or caution about the risks of unintended command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly says Cascade tracks real-time actions including clipboard activity, but it does not pair that disclosure with a privacy warning or guidance on handling sensitive data. In a developer tool context, clipboard contents and activity traces may contain credentials, proprietary code, or personal data, so omission of a warning meaningfully increases the risk of unintended exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill documents Web Search and MCP external tool access as built-in capabilities without warning that prompts, code snippets, filenames, or metadata may be transmitted to third-party services. Because this skill is a how-to guide for enabling agent features, users may invoke external integrations without realizing the data exposure boundary.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The memory feature persists context across sessions, including auto-generated and user-created memories, but the documentation does not emphasize that sensitive code, secrets, or personal data could be retained beyond the immediate task. Persistent agent memory increases privacy and confidentiality risk, especially in shared workspaces or regulated environments.

Content

Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.

md

### Memories

- **Auto-generated**: Cascade creates memories when it encounters useful context. Does NOT consume credits.
- **User-created**: Type `create memory ...` in Cascade to manually save context.
- Auto-generated memories are workspace-specific.

**Managing Memories:**

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The 'Auto-execute' wording confirms the system may act independently rather than merely suggest commands, which increases the blast radius of model mistakes or prompt injection. In an IDE agent with terminal access, autonomous execution can directly affect source code, local data, credentials, and connected infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 290)May include surrounding context.

md

1. **Manual**: Always ask for permission (default)
2. **Semi-auto**: Auto-run safe commands
3. **Turbo Mode**: Auto-execute all commands without confirmation
4. **Custom**: Use Allow/Deny lists for specific commands

### Dedicated Terminal (Wave 13)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The 'Auto-execute' wording confirms the system may act independently rather than merely suggest commands, which increases the blast radius of model mistakes or prompt injection. In an IDE agent with terminal access, autonomous execution can directly affect source code, local data, credentials, and connected infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 290)May include surrounding context.

md

1. **Manual**: Always ask for permission (default)
2. **Semi-auto**: Auto-run safe commands
3. **Turbo Mode**: Auto-execute all commands without confirmation
4. **Custom**: Use Allow/Deny lists for specific commands

### Dedicated Terminal (Wave 13)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The MCP configuration example shows a GitHub token embedded directly in configuration without warning against hardcoding secrets or exposing config files. This can normalize insecure secret handling and lead users to store long-lived credentials in plaintext, increasing the likelihood of token leakage through source control, logs, screenshots, or shared workspaces.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

md

- **Model Flexibility**: Switch between SWE-1.5, Claude, GPT-5.x, Gemini 3, and BYOK models
- **Parallel Sessions**: Run multiple Cascade sessions simultaneously with Git worktrees support
- **Dedicated Terminal**: Reliable zsh shell for agent command execution
- **Turbo Mode**: Auto-execute terminal commands without manual confirmation
- **Fast Context**: SWE-grep powered code retrieval up to 20x faster

## Contents

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · Windsurf/README.md (reported line 19)May include surrounding context.

md

- **Model Flexibility**: Switch between SWE-1.5, Claude, GPT-5.x, Gemini 3, and BYOK models
- **Parallel Sessions**: Run multiple Cascade sessions simultaneously with Git worktrees support
- **Dedicated Terminal**: Reliable zsh shell for agent command execution
- **Turbo Mode**: Auto-execute terminal commands without manual confirmation
- **Fast Context**: SWE-grep powered code retrieval up to 20x faster

## Contents

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation states that 'Turbo Mode' can auto-execute terminal commands without manual confirmation, which can affect system integrity. In this README, that capability is presented as a feature but no caution, risk disclosure, or user warning is provided about unintended command execution or destructive actions.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

bash

# macOS - create symlink manually if needed
sudo ln -sF /Applications/Windsurf.app/Contents/Resources/app/bin/windsurf /usr/local/bin/windsurf

# Open a project from terminal
windsurf /path/to/project

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · Windsurf/SKILL.md (reported line 29)May include surrounding context.

bash

# macOS - create symlink manually if needed
sudo ln -sF /Applications/Windsurf.app/Contents/Resources/app/bin/windsurf /usr/local/bin/windsurf

# Open a project from terminal
windsurf /path/to/project

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that Cascade tracks real-time actions including edits, terminal activity, and clipboard contents, but it does not warn users that sensitive code, credentials, or personal data may be collected or processed. In a developer tool skill, this omission can lead users to expose confidential data without informed consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill promotes persistent memories across sessions without warning that sensitive context may be retained and later surfaced unexpectedly. In an AI coding assistant, session persistence can preserve credentials, internal architecture details, or confidential business context beyond the immediate task.

Content

Scanner excerpt · Windsurf/SKILL.md (reported line 239)May include surrounding context.

md

### Memories

- **Auto-generated**: Cascade creates memories when it encounters useful context. Does NOT consume credits.
- **User-created**: Type `create memory ...` in Cascade to manually save context.
- Auto-generated memories are workspace-specific.

**Managing Memories:**

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill documents a mode that auto-executes all commands without confirmation but does not include a strong warning about destructive commands, unintended side effects, or use in privileged environments. Because this skill is specifically about an autonomous coding agent with terminal access, omission of safeguards materially increases operational risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The specific promise of 'Auto-execute' at this line reinforces that the agent may take actions without user confirmation. In a skill intended to teach agent use, that omission is materially dangerous because readers may adopt unsafe defaults in real repositories or systems.

Content

Scanner excerpt · Windsurf/SKILL.md (reported line 290)May include surrounding context.

md

1. **Manual**: Always ask for permission (default)
2. **Semi-auto**: Auto-run safe commands
3. **Turbo Mode**: Auto-execute all commands without confirmation
4. **Custom**: Use Allow/Deny lists for specific commands

### Dedicated Terminal (Wave 13)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The specific promise of 'Auto-execute' at this line reinforces that the agent may take actions without user confirmation. In a skill intended to teach agent use, that omission is materially dangerous because readers may adopt unsafe defaults in real repositories or systems.

Content

Scanner excerpt · Windsurf/SKILL.md (reported line 290)May include surrounding context.

md

1. **Manual**: Always ask for permission (default)
2. **Semi-auto**: Auto-run safe commands
3. **Turbo Mode**: Auto-execute all commands without confirmation
4. **Custom**: Use Allow/Deny lists for specific commands

### Dedicated Terminal (Wave 13)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The MCP section encourages connecting external tools and services but does not warn that repository content, prompts, environment variables, or secrets may be shared with those tools. This is risky because MCP integrations extend the trust boundary beyond the IDE and may execute with access to sensitive local context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The voice input section mentions speech-to-text transcription without warning that spoken content may be transmitted to external services or logged. Users may dictate secrets, customer data, or proprietary information without understanding the privacy implications.

Content

No source excerpt is available for this finding.