Back to skill

Security audit

cursor-doctor

Security checks for vulnerabilities and agentic risk

Overview

The skill is a plausible Cursor repair tool, but it needs Review because some fixes can close Cursor, delete caches, reset settings, and expose proxy values without enough user confirmation or installation clarity.

Review this before installing. Prefer installing only from a verified, pinned source, run diagnosis before any fix, and avoid repair commands unless Cursor work is saved and you are comfortable with caches or settings being changed. Redact proxy environment variables before sharing output.

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
cursor_doctor/fixes/apply.py:25
Finding

Destructive repair operations execute without confirmation and can report false success

Content
View full analysis
str: steps = [] stdout, stderr, rc = _run_cmd(["pkill", "-f", "Cursor"]) steps.append("✅ Cursor processes terminated") home = os.path.expanduser("~") mcp_dir = os.path.join(home, ".cursor", ".mcp") if os.path.isdir(mcp_dir): try: shutil.rmtree(mcp_dir, ignore_errors=True) steps.append("✅ MCP cache cleared") except Exception: steps.append("⚠️ Unable to clear MCP cache; manual deletion required") ``` ```python def fix_crash_clear_cache() -> str: steps = [] home = os.path.expanduser("~") cache_dirs = [ os.path.join(home, "Library", "Application Support", "Cursor", "Cache"), os.path.join(home, "Library", "Application Support", "Cursor", "CachedData"), os.path.join(home, "Library", "Application Support", "Cursor", "Code Cache"), os.path.join(home, ".cursor", ".mcp"), ] for d in cache_dirs: if os.path.isdir(d): try: shutil.rmtree(d, ignore_errors=True) steps.append(f"✅ Cleared: {os.path.basename(d)}") except Exception: steps.append(f"⚠️ Failed to clear: {os.path.basename(d)}") _run_cmd(["pkill", "-f", "Cursor"]) steps.append("✅ Cursor processes terminated") ``` ```python if os.path.isfile(settings_file): try: shutil.copy2(settings_file, backup_file) steps.append(f"✅ Configuration backed up to {backup_file}") with open(settings_file, "w") as f: json.dump({}, f) steps.append("✅ Configuration reset to defaults") ...[truncated 2920 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
cursor_doctor/fixes/apply.py:72
Finding

Proxy credentials can be disclosed through unredacted terminal output

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:29
Finding

Unpinned and contradictory installation sources create supply-chain exposure

Content
View full analysis
=8.0", "rich>=13.0", "httpx>=0.27", "pyyaml>=6.0", "psutil>=5.9", ] ``` ### Technical Analysis The Skill installation instructions direct an agent or user to resolve `cursor-doctor` from the default Python package index, while the project README states that the intended package has not been published there. This discrepancy creates a dependency-confusion opportunity: an unrelated or subsequently registered package using that name could be installed instead of the audited project. The alternative Git installation command does not identify a release tag or commit hash. It therefore installs whatever code is present on the repository's default branch at installation time, which may differ from the audited artifact. The runtime dependencies are also not reproducibly pinned. Only minimum versions are specified, with no lock file or integrity hashes. Future releases satisfying those constraints can be selected without further review. In addition, `httpx` and `pyyaml` appear unused in the reviewed source, increasing dependency attack surface without providing current functionality. No evidence was found that any listed dependency is currently malicious. The finding concerns unsafe and non-repro ...[truncated 1841 chars]
Remediation
View remediation
" ``` 4. Publish signed release artifacts and document checksums or provenance attestations. 5. Introduce a dependency lock file with exact versions and integrity hashes for reproducible installation. 6. Set appropriate upper bounds where compatibility and security policy require them. 7. Remove unused `httpx` and `pyyaml` dependencies unless they are required by functionality not present in the reviewed source. 8. Use automated dependency review and vulnerability scanning for every dependency update. 9. Resolve the version inconsistency between `SKILL.md` (`1.1.0`) and the Python package metadata (`0.1.0`) so users can verify what release they are installing. ]]>
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (26)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High
Category
YARA Match
Confidence
85% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

�、崩溃、配置问题,并提供智能修复方案。

Cursor IDE Error Diagnostic & Repair Tool — One-command diagnosis and intelligent fix for Cursor errors, crashes, and configuration issues.


📦 Installation / 安装

⚠️ cursor-doctor is NOT published on PyPI yet. Use one of the methods below.

Method 1: Install directly from GitHub (recommended)

bash
pip install git+https://github.com/minirr890112-byte/cursor-doctor.git

Method 2: Clone and install in editable mode

bash
git clone https://github.com/minirr890112-byte/cursor-doctor.git
cd cursor-doctor
pip install -e .

Prerequisites / 依赖

  • Python 3.10+
  • pip 21.0+

🚀 Quick Start / 快速开始

bash
# Diagnose your Cursor environment / 诊断 Cursor 环境
cursor-doctor diagnose

# Auto-fix detected issues / 自动修复
cursor-doctor fix

# Browse built-in error signature database / 浏览错误签名库
cursor-doctor signatures

# Match an error me

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The configuration reset overwrites the user's settings.json with an empty object, which irreversibly removes active configuration unless the user later restores the backup manually. Because this is an automated 'apply fix' path with no prior warning or confirmation, it can cause significant loss of user preferences and break working environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README advertises auto-fix actions such as terminating Cursor processes and clearing caches, but it does not clearly warn users about operational side effects such as losing unsaved work, removing state, or requiring re-authentication/reconfiguration. In a diagnostic/repair tool, users may run these commands expecting safe maintenance, so the missing warning increases the risk of unintended disruption or data/configuration loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The config reset command is presented as an available fix without a prominent warning that settings.json will be modified or restored to defaults. Resetting editor settings can remove user customizations, break workflows, and potentially discard important configuration if backup/restore behavior is not made explicit.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill declares a prerequisite command and the analyzer detected capabilities consistent with shell, environment, and file access, but the manifest does not define any explicit tool scope or allowed-tools boundary. In an agent setting, missing capability constraints can cause the skill to run with broader-than-necessary privileges, increasing the chance of unintended command execution, file modification, or environment disclosure if the skill is invoked or extended unsafely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill title, section headings, and explanatory text switch into Chinese in multiple places, while other parts remain in English. Because the document does not state that it is Chinese-only or offer an alternate language option, it implicitly imposes a language requirement on users, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code file contains the primary CLI docstrings and output strings in Chinese, including the top-level tool description and command help text. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is clearly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

User-visible text throughout the file, including the module description, return strings, docstrings, and generated summary, is hard-coded in Chinese. This imposes a specific language/locale on users without opt-in, which matches the policy's language-choice violation criterion.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The diagnostic routine goes beyond passive inspection and executes multiple local binaries discovered from PATH or filesystem locations. In an agent-skill setting, this expands the attack surface because a compromised environment or PATH hijack could cause unintended code execution when the skill runs supposedly routine checks.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · cursor_doctor/diagnose.py (reported line 67)May include surrounding context.

python
if not self.cursor_binary:
            return "未找到 Cursor"
        try:
            result = subprocess.run(
                [self.cursor_binary, "--version"],
                capture_output=True, text=True, timeout=10
            )

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The code recursively scans user log files and collects environment attributes including shell and proxy presence without any visible notice, consent, minimization, or output redaction. In developer environments, logs and configuration details often contain tokens, internal URLs, usernames, filesystem paths, and network topology clues, so indiscriminate collection can expose sensitive information.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · cursor_doctor/diagnose.py (reported line 118)May include surrounding context.

python
# Node.js / npm
        for cmd in ["node", "npm"]:
            try:
                r = subprocess.run([cmd, "--version"], capture_output=True, text=True, timeout=5)
                checks[cmd] = r.stdout.strip() or "未安装"
            except Exception:
                checks[cmd] = "未安装"

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · cursor_doctor/diagnose.py (reported line 125)May include surrounding context.

python
# Git
        try:
            r = subprocess.run(["git", "--version"], capture_output=True, text=True, timeout=5)
            checks["git"] = r.stdout.strip() or "未安装"
        except Exception:
            checks["git"] = "未安装"

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

All user-facing strings, docstrings, and console messages in this file are in Chinese, with no indication that the user can choose another language. This creates a language-policy concern because the skill effectively enforces a specific locale without opt-in or documented justification.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · cursor_doctor/fixes/apply.py (reported line 18)May include surrounding context.

python
def _run_cmd(cmd: list[str], timeout: int = 30) -> tuple[str, str, int]:
    """运行系统命令"""
    try:
        r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return r.stdout, r.stderr, r.returncode
    except FileNotFoundError:
        return "", "命令未找到", -1

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This fix path deletes local cache data and terminates Cursor processes immediately, without any explicit user confirmation or dry-run preview. In a repair tool, such behavior can cause data loss, interrupt active work, or destroy potentially useful diagnostic state if triggered accidentally or by misleading upstream diagnosis.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · cursor_doctor/fixes/apply.py (reported line 104)May include surrounding context.

python
config_dir = os.path.join(home, ".cursor", "User")
    
    settings_file = os.path.join(config_dir, "settings.json")
    backup_file = settings_file + ".backup." + str(int(__import__('time').time()))
    
    if os.path.isfile(settings_file):
        try:

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module docstring and multiple field comments/descriptions explicitly state and implement the signature database in Chinese, such as '基于中文社区' and '中文诊断描述', with no indication that language selection is optional. This is a natural-language locale policy issue because the file hard-codes a specific language experience without user opt-in or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The top-level description is written only in Chinese ("Cursor IDE 故障诊断与修复工具"), which suggests a fixed language presentation without any visible opt-in, alternative locale, or justification for a region-specific tool. This can violate language/locale policy when users are not given a choice.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This is a manifest file, so vague-trigger review applies. The description advertises a 'one-click' tool for diagnosing and fixing Cursor errors, crashes, and configuration issues, but does not define boundaries, exclusions, or specific trigger conditions, which could encourage overly broad invocation for many routine problems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The package metadata description is written entirely in Chinese and does not indicate that language is optional or region-specific. Under the policy, forced language or locale without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: click has 1 known advisory(ies) (CVE-2026-7246 (Pallets Click, versions 8.3.2 and below, contain a command injection vulnerabili)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: httpx has 2 known advisory(ies) (CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pyyaml has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: psutil has 2 known advisory(ies) (CVE-2019-18874 (Double Free in psutil); CVE-2019-18874 (psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs bec)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.