Agent CLI (Cursor + Qoder)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:06 AM UTC
• Version: 3.0.0

Overview

This skill is a coherent code-agent helper, but it documents risky installation and automation shortcuts that can bypass user review or run changing third-party code.

Review before installing. Prefer verified package-manager installs over curl-to-bash, pin and vet any MCP packages, avoid --force or --yolo unless the task is tightly scoped, do not auto-accept workspace trust, restrict tools and directories, and review diffs before accepting changes from Cursor or Qoder.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/README.md:21

Finding

Remote Installer Is Executed Directly Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: references/README.md:21
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Critical

bash

curl https://cursor.com/install -fsS | bash

Technical Analysis

The installation command sends the response from a mutable external URL directly to Bash. It does not pin an installer version, verify a cryptographic checksum or signature, save the script for inspection, or obtain explicit approval after showing its contents.

Although the URL is consistent with the named Cursor product, the effective payload can change after this Skill has been reviewed. Compromise of the vendor infrastructure, distribution endpoint, DNS resolution, TLS trust chain, or installer publishing process could therefore turn this command into an arbitrary-code execution channel.

Piping directly to Bash is not the minimum privilege necessary to document or install the CLI. A package manager or a separately downloaded and verified artifact would provide stronger integrity and review controls.

Attack Path

1. An attacker compromises or gains influence over the remote installer or its delivery infrastructure.
2. The installer response is replaced with malicious shell commands.
3. A user follows the documented installation instruction.
4. curl retrieves the altered response and immediately passes it to Bash.
5. The malicious commands execute with all permissions available to the invoking user.

Impact Assessment

Successful exploitation permits arbitrary command execution under the invoking account. The payload could read or modify user-accessible source repositories, configuration files, shell startup files, SSH material, API credentials, and other sensitive data. It could also install additional software or establish user-level persistence. Root-level access is not inherent in the command, but the impact would increase if it were run from a privileged shell.

Remediation

View remediation

Remediation Suggestions

• Prefer a signed, version-pinned package distributed through a verified package manager.
• If an installer script is unavoidable, download it to a local file rather than piping it directly to a shell.
• Pin an immutable installer release and publish its expected SHA-256 digest.
• Verify a vendor signature or checksum through an independent trusted channel before execution.
• Display or inspect the downloaded script and require explicit user approval before running it.
• Execute the installer as an unprivileged user and document all files and configuration it is expected to modify.
• Provide the Homebrew installation method as the preferred option where supported.

T08 · Insecure Dependencies

Error

• Location: references/qodercli.md:100

Finding

Unpinned MCP Packages Are Downloaded and Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: references/qodercli.md:100, 121-123
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

bash

qodercli mcp add playwright -- npx -y @playwright/mcp@latest

qodercli mcp add context7 -- npx -y @upstash/context7-mcp@latest
qodercli mcp add deepwiki -- npx -y mcp-deepwiki@latest
qodercli mcp add chrome-devtools -- npx chrome-devtools-mcp@latest

Technical Analysis

These commands cause npx to retrieve and execute third-party package code. Three commands explicitly select the mutable latest tag, while the fourth omits a version and consequently resolves according to the registry's current package metadata. The -y option also suppresses the normal installation confirmation for three packages.

Because no exact version or integrity value is supplied, the packages executed in the future may differ from those that existed when the Skill was audited. A compromised maintainer account, malicious release, registry compromise, or transitive dependency compromise could introduce attacker-controlled code.

MCP servers are especially sensitive dependencies because they can remain integrated with an agent workflow and expose tools or process repository context. Their authority should therefore be constrained more carefully than that of an ordinary development dependency.

Attack Path

1. An attacker compromises a listed package, its publisher account, or one of its dependencies.
2. The attacker publishes a malicious version under latest, or otherwise changes the version resolved by the unpinned package name.
3. A user runs one of the documented qodercli mcp add commands.
4. npx downloads and executes the malicious package under the user's account.
5. The package can execute local code and may subsequently be registered as an MCP server available to the agent.

Impact Assessment

Exploitation can provide code execution with the invoking user ...[truncated 345 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest and unversioned package references with exact, reviewed versions.
• Use a lockfile and verify registry integrity metadata before execution.
• Verify package ownership, provenance, release signatures, and publisher history.
• Remove -y so users must explicitly approve package retrieval and execution.
• Install and test MCP servers in a sandbox or container with restricted filesystem and network access.
• Grant each MCP server only the tools and directories required for its stated purpose.
• Require explicit user approval before registering a new MCP server.
• Establish a controlled update process that reviews new versions before changing the pinned version.

T09 · Insecure Skill Coding Practices

Error

• Location: references/cursorcli.md:149

Finding

Workspace Trust Is Accepted Through an Unvalidated Timed Keystroke

Content

View full analysis

Vulnerability Details

File Location: references/cursorcli.md:149-150
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

bash

sleep 3
tmux send-keys -t cursor "a"

Technical Analysis

The automation waits for a fixed period and then sends a to the active terminal without first capturing and validating the displayed prompt. The surrounding documentation identifies this operation as acceptance of first-time workspace trust.

Fixed delays do not establish which interface element currently has focus. Startup timing, network latency, version changes, an earlier error, or unexpected project behavior could leave a different prompt active. The keystroke could consequently approve an unintended operation. It also removes the meaningful user review that a workspace-trust boundary is intended to provide.

Automatically trusting an arbitrary workspace exceeds the minimum privilege necessary to start the CLI. Trust should be based on explicit user approval after the workspace identity and requested permissions are shown.

Attack Path

1. A user opens an untrusted or attacker-controlled repository through the documented automation.
2. The CLI displays a trust prompt, or startup timing causes another confirmation prompt to be active after three seconds.
3. The automation blindly sends a to the terminal.
4. The current prompt interprets the keystroke as approval.
5. The agent proceeds with expanded workspace access or performs another unintended confirmed action.

Impact Assessment

The direct impact is unauthorized approval within the Cursor CLI session. Once trusted, the agent may be able to read or modify repository files and execute operations allowed by its configured tools. The exact scope depends on the CLI configuration and invoking account; the snippet does not itself grant operating-system administrator privileges.

Remediation

View remediation

Remediation Suggestions

• Remove automatic workspace-trust acceptance.
• Capture the terminal output and verify the exact prompt before responding to any confirmation.
• Display the resolved workspace path and trust implications to the user.
• Require explicit user approval for every previously untrusted workspace.
• Abort safely if the expected prompt does not appear within a bounded timeout.
• Prefer a documented noninteractive mode with explicit, narrowly scoped permissions rather than TUI keystroke automation.
• Run untrusted repositories in a sandbox with restricted filesystem, process, credential, and network access.

T09 · Insecure Skill Coding Practices

Error

• Location: references/cursorcli.md:229

Finding

Security Audit Example Disables Confirmation and Permits Automatic Modification

Content

View full analysis

Vulnerability Details

File Location: references/cursorcli.md:229
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

bash

agent -p "audit security" --output-format json --force

Technical Analysis

The documented --force option is described as skipping confirmation and automatically modifying code. Applying it to a security-audit command removes an important control boundary from a task that would normally be expected to inspect and report rather than alter the repository.

Model output and repository instructions are not inherently trustworthy. If the repository contains adversarial instructions, misleading context, or unsafe task configuration, confirmation bypass can allow resulting modifications to occur without review.

Read-only analysis is sufficient for the declared audit purpose, so automatic modification exceeds the minimum privilege required by this example.

Attack Path

1. An attacker places misleading or adversarial content in a repository accessible to the agent.
2. A user invokes the documented security-audit command with --force.
3. The agent processes repository content and decides to perform changes or commands.
4. Confirmation checks are bypassed.
5. Project files are modified without an intervening user review step.

Impact Assessment

The command may modify any project files writable by the invoking user and accessible to the agent. Depending on the CLI's enabled tools, consequences may include source-code tampering, build configuration changes, test or CI modification, and execution of project commands. The evidence does not establish automatic administrator-level privilege escalation.

Remediation

View remediation

Remediation Suggestions

• Remove --force from all review and audit examples.
• Run security audits with read-only tool permissions.
• Separate analysis from remediation into distinct phases.
• Require the agent to produce a proposed patch or diff for user review before applying changes.
• Require explicit approval before command execution or file modification.
• Limit filesystem access to the intended repository and deny access to credentials and unrelated directories.
• Record all proposed and completed operations in an auditable log.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:18

Finding

Mandatory Delegation Routes Routine Code Changes to Privileged External Agents

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:18
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

text

Writing, editing, or refactoring code must use Cursor CLI or Qoder CLI; direct execution-based editing is prohibited.

Technical Analysis

The Skill imposes a mandatory routing rule whenever code is written, edited, or refactored. This changes the active agent's tool-selection behavior and prevents it from choosing a simpler local mechanism, even when external delegation is unnecessary.

Cursor and Qoder are documented as having repository read/write and command-execution capabilities. Mandatory delegation may therefore expose project context to external agent services and grants broader capabilities than a small local edit requires. The routing behavior is consistent with the Skill's advertised purpose, but making it unconditional conflicts with least-privilege operation.

Attack Path

1. The Skill is loaded for a routine code-editing task.
2. Its mandatory instruction prevents use of a lower-privilege local editing path.
3. The task and repository context are delegated to Cursor CLI or Qoder CLI.
4. The external agent obtains the filesystem and tool access enabled by its configuration.
5. Project information may be processed externally, and the delegated agent may modify files or execute commands beyond what a minimal edit required.

Impact Assessment

The rule can expose source code and task context to external services and can grant an external agent read, write, or command-execution access to the working tree. The precise scope depends on tool configuration and user permissions. No evidence shows that this instruction alone grants administrator access or bypasses operating-system access controls.

Remediation

View remediation

Remediation Suggestions

• Change mandatory delegation into an optional routing recommendation.
• Obtain informed user approval before sending repository context to an external agent.
• Clearly disclose whether code or prompts may be processed by a remote service.
• Permit local editing for simple tasks that do not require external-agent functionality.
• Default delegated agents to read-only or narrowly scoped tool permissions.
• Enable write or shell access only when necessary for the specific task.
• Review and display proposed changes before applying them.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (19)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The README instructs users to fetch a remote script and immediately execute it with bash. This is dangerous because it grants whatever content is served from https://cursor.com/install direct code execution on the user's machine, with no integrity verification, review step, or pinning to a known artifact. In a developer tooling skill, users are especially likely to copy-paste such commands, which increases exploitation risk if the remote endpoint, CDN, DNS, or transport path is compromised.

Content

Scanner excerpt · references/README.md (reported line 21)May include surrounding context.

通用（macOS / Linux / WSL）

bash

curl https://cursor.com/install -fsS | bash

macOS（Homebrew）

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The | bash construct is the core unsafe behavior because it turns downloaded network content directly into executable shell commands. This removes any opportunity for inspection or integrity checks and can lead to full local compromise if the upstream script is malicious or tampered with. Because this skill is specifically about installing and using code-editing agent CLIs, the audience is likely to run the command in privileged developer environments, making the blast radius larger.

Content

Scanner excerpt · references/README.md (reported line 21)May include surrounding context.

通用（macOS / Linux / WSL）

bash

curl https://cursor.com/install -fsS | bash

macOS（Homebrew）

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/cursorcli.md (reported line 34)May include surrounding context.

bash

agent models
agent --model gpt-5

交互内：

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill description and usage guidance are broad enough to capture a wide range of ordinary coding tasks, including generic code editing, refactoring, review, and automation. In an agent-routing system, this can cause over-invocation of a powerful external CLI skill without clear boundaries or confirmation, increasing the chance of unintended code changes, opaque delegation, or prompt/instruction injection reaching downstream tools.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description is written as an instruction set in Chinese and presents the tool behavior in a single language without offering the user a language choice. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless it is clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide explicitly recommends --force to skip confirmation and automatically modify code, but it does not pair that recommendation with guardrails such as dry-run guidance, scope restrictions, or warnings about destructive edits. In an agent/CLI automation context, removing confirmation materially increases the chance of unintended code changes, unsafe refactors, or security-relevant modifications being applied without human review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The tmux automation example sends a to auto-accept the initial workspace trust prompt, effectively bypassing an important security boundary without verification. If run in an untrusted or attacker-controlled repository, this can enable loading repository-specific rules, config, or integrations that influence the agent’s behavior and increase exposure to prompt injection or unsafe tool actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description and operational guidance are presented in Chinese, and the document does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking audience. The policy requires flagging language or locale constraints when a specific language is effectively forced without user opt-in or clear justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill metadata frames the tool as a code-editing CLI, but the referenced commands include account operations, connectivity, agent management, background bash tasks, and other broader capabilities. That scope mismatch can mislead users or higher-level policy layers into granting trust or permissions beyond what the manifest suggests.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This section documents MCP integration and external service connectivity that materially exceeds a narrow code-editing description. Hidden or under-disclosed network and plugin execution surfaces increase the chance of unsafe delegation, unreviewed outbound access, and unexpected code execution in agent workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The documentation instructs users to launch an MCP server via npx using a moving package target rather than a fully pinned package version. This creates a supply-chain risk: future upstream changes or a compromised package version could execute unexpected code when the command is run.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This example references an MCP package through npx without a pinned version, so the code fetched and executed may change over time. In an agent tooling context, that is especially risky because MCP servers often receive broad local and browser-facing capabilities.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The command runs an external MCP server package by name only, allowing the latest published version to be fetched at execution time. That exposes users to package hijacking, malicious updates, or breaking behavior outside the skill author's control.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

This documentation recommends executing a network-fetched package without an explicit version pin. Because the package can interact with browser tooling, a compromised or changed release could expand access to sensitive local or web session data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The permission model explicitly includes arbitrary Bash and WebFetch capabilities, which are substantially broader than code editing and can enable command execution and outbound network access. In an agent skill, under-describing these powers can cause unsafe use in contexts that assumed only local code modification.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/qodercli.md (reported line 186)May include surrounding context.

md

需含 **frontmatter**：`name`、`description`、`tools`，正文为 system prompt。

创建：`/agents` → Tab 选 User/Project → Create new agent。

使用：TUI 内 `/agent` 查看；可显式写「使用 xxx subagent」或依赖模型隐式调度、多步串联。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/qodercli.md (reported line 186)May include surrounding context.

md

需含 **frontmatter**:`name`、`description`、`tools`,正文为 system prompt。

创建:`/agents` → Tab 选 User/Project → Create new agent。

使用:TUI 内 `/agent` 查看;可显式写「使用 xxx subagent」或依赖模型隐式调度、多步串联。

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The description states the skill guidance in Chinese and the document consistently enforces that locale without indicating user opt-in or a region-specific justification. Under the policy, forcing a specific language without choice can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The skill description includes qodercli rm <jobId> to delete a worktree task and notes it is irreversible, but it does not provide any broader user warning about potential loss of task state or associated data. For markdown files, destructive behaviors that may affect user data or system integrity should be accompanied by a clear warning/disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.