ClawHub
Back to skill

Security audit

Cursor CLI Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Cursor CLI guide, but it recommends unsafe installation and automation patterns that can execute unverified code or bypass workspace trust review.

Review this skill carefully before installing. Prefer a package-managed or verified Cursor CLI installer instead of `curl | bash`, do not automate workspace trust approval for unreviewed repositories, and avoid `--force` unless you are working in a controlled branch or sandbox with review and rollback available.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:17
Finding

Unverified Remote Installer Executed Directly by Bash

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:29
Finding

Quick Start Executes a Mutable Remote Installer Without Verification

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:172
Finding

Automation Unconditionally Accepts Workspace Trust

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (10)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

This is a direct example of external script fetching followed by execution: curl https://cursor.com/install -fsS | bash. That pattern creates a strong supply-chain and remote-code-execution risk because the fetched content is not pinned, authenticated beyond TLS, or validated before being run.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

Install the Cursor CLI:

bash
# Standard installation (macOS, Linux, WSL)
curl https://cursor.com/install -fsS | bash

# Homebrew (macOS only)
brew install --cask cursor-cli

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The | bash construct is dangerous because it turns network-retrieved data into immediately executed shell code with no review boundary. In the context of a developer skill, this is especially risky because users may copy-paste the command into privileged environments, CI runners, or workstations, magnifying the blast radius of any compromise.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

Install the Cursor CLI:

bash
# Standard installation (macOS, Linux, WSL)
curl https://cursor.com/install -fsS | bash

# Homebrew (macOS only)
brew install --cask cursor-cli

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

curl https://cursor.com/install -fsS | bash fetches remote content and immediately executes it without independent verification. If the server, transport, installer, or DNS path is compromised, users may execute attacker-controlled code on their machine.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

Standard Installation (macOS, Linux, Windows WSL)

bash
curl https://cursor.com/install -fsS | bash

Homebrew (macOS only)

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The | bash chaining pattern turns a network fetch directly into code execution, eliminating opportunities for review and integrity validation. In a skill intended to guide automation and engineering workflows, this is especially dangerous because users are likely to copy-paste it verbatim.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

Standard Installation (macOS, Linux, Windows WSL)

bash
curl https://cursor.com/install -fsS | bash

Homebrew (macOS only)

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

Use a specific model:

bash
agent --model gpt-5

Switch models during a session:

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Automating the workspace trust prompt by blindly sending a bypasses a security decision intended to protect users from untrusted projects. Trusting a workspace can enable execution of project-defined rules, commands, or integrations, so this guidance normalizes unsafe approval without review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README instructs users to download and immediately execute a remote script via a shell pipeline, with no integrity verification, content inspection, or warning about the trust implications. If the remote endpoint, distribution path, or network path is compromised, users could execute arbitrary code on their systems during installation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
76% confidence
Finding

Documenting --force as auto-applying changes without confirmation encourages unattended modification of code or project files. In an agent automation context, this increases the chance of unintended edits, destructive changes, or unsafe actions being applied without human review.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

agent -p 'Run tests' --output-format stream-json --stream-partial-output

text

**Force mode (auto-apply changes without confirmation):**

```bash
agent -p 'Fix all linting errors' --force

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

bash
# 1. Install tmux if not available
sudo apt install tmux  # Ubuntu/Debian
brew install tmux      # macOS

# 2. Create a tmux session

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documented tmux kill-session -t cursor command is destructive and can terminate an existing session without checking whether it contains in-progress work. In an automation-focused skill, readers may copy this verbatim, causing accidental loss of state, commands, or unsaved terminal work.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.