Cursor IDE Agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:31 AM UTC
• Version: 3.0.2

Overview

This is a real Cursor coding workflow, but it includes high-risk install and automation instructions that should be reviewed before use.

Install only if you trust Cursor's installer source and are comfortable with a local/cloud coding agent that can modify files, run commands, and interact with Git. Prefer a signed or package-manager install path over `curl | bash`, avoid `--force` until changes are reviewed in version control, keep sandboxing enabled where possible, and do not use cloud handoff with secrets, regulated data, or proprietary repositories unless approved.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:46

Finding

Unverified Remote Installer Piped Directly into Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 46
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash

# Install
curl https://cursor.com/install -fsS | bash

Technical Analysis

The installation instruction downloads content from a mutable external URL and passes it directly to Bash. The response is executed before the user can inspect it, and the instruction does not pin an installer version or verify a cryptographic signature or checksum.

HTTPS provides transport protection but does not establish that every future payload served by the endpoint is safe. Compromise of the vendor endpoint, publishing infrastructure, account, DNS resolution, or certificate trust chain could cause arbitrary attacker-controlled shell commands to be returned and executed.

Installing Cursor CLI is relevant to the Skill's declared functionality, but piping an unverified network response directly into a shell is not the minimum-risk method needed to perform that installation. The same objective can be achieved using a signed package, a version-pinned artifact, or a separately downloaded and verified installer.

Attack Path

1. An attacker compromises or gains control over the installer endpoint or its delivery infrastructure.
2. The attacker changes the response from https://cursor.com/install to include malicious shell commands.
3. A user or Agent follows the documented prerequisite and runs the command.
4. curl retrieves the attacker-controlled response.
5. The pipe sends the response directly to Bash without inspection or integrity validation.
6. Bash executes the payload with the permissions of the invoking account.
7. The payload can access or alter resources available to that account and may attempt persistence or further compromise.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user ...[truncated 532 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the curl | bash instruction with installation through a trusted package manager using a version-pinned, signed release.
• If a standalone installer is required, download it to a local file rather than executing it through a pipe.
• Publish and verify a cryptographic signature using a securely distributed vendor signing key.
• Publish and verify a SHA-256 checksum for the exact pinned installer version.
• Allow the user to inspect the downloaded installer before execution.
• Require explicit user approval before executing any installer or permitting system changes.
• Run installation with ordinary user privileges and request elevated privileges only for a narrowly defined operation when strictly necessary.
• Document the expected files, directories, network access, and configuration changes made by the installer.
• Prefer a hardened sequence such as download, signature verification, checksum validation, review, and then execution.

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:29

Finding

Quick-Start Documentation Executes an Unverified Remote Script

Content

View full analysis

Vulnerability Details

File Location: README.md, line 29
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash

# Standard installation (macOS, Linux, WSL)
curl https://cursor.com/install -fsS | bash

Technical Analysis

The quick-start documentation instructs users to retrieve a script from an external, mutable endpoint and execute it immediately in Bash. No installer version is pinned, and no checksum or publisher signature is validated. The pipeline also prevents a normal review step between retrieval and execution.

This duplicates the unsafe installation pattern in SKILL.md and increases exposure because users commonly copy quick-start commands without examining their behavior. Although obtaining the Cursor CLI is necessary for the documented workflow, immediate execution of unverified network content exceeds the minimum behavior required to install it safely.

The presence of a Homebrew alternative does not mitigate the vulnerable standard-installation instruction because users on Linux, WSL, or systems without Homebrew are still directed to use the unsafe pipeline.

Attack Path

1. An attacker compromises the external installer endpoint or an element of its software-delivery chain.
2. The endpoint begins serving a modified shell script containing attacker-selected commands.
3. A user copies the standard installation command from the README.
4. curl downloads the modified content from the mutable URL.
5. The shell pipeline passes that content to Bash without validation or an opportunity for review.
6. Bash executes the commands with the user's current privileges.
7. The malicious script can compromise files, credentials, repositories, and development tooling accessible to the user.

Impact Assessment

Exploitation can result in arbitrary local command execution with the permissions of the account performing installation. P ...[truncated 392 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the direct network-to-shell pipeline from the quick-start documentation.
• Make a signed, version-pinned package-manager installation the recommended path.
• For platforms without a supported package manager, provide a pinned download URL and require signature and checksum validation before execution.
• Show the download, verification, and execution steps as separate commands.
• Explain how users can inspect the installer and identify its expected publisher signature.
• Require explicit approval before installer execution and advise against running it as root or an administrator.
• Keep checksum and signature metadata on an independently protected distribution channel where practical.
• Ensure README.md and SKILL.md use the same hardened installation procedure so the unsafe command is not reintroduced through duplicated documentation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The README instructs users to fetch a remote script over the network and immediately execute it with bash. This is dangerous because any compromise of the hosting domain, transport path, or install script contents would result in arbitrary code execution on the user's machine, and users are given no verification step before execution.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

Install the Cursor CLI:

bash

# Standard installation (macOS, Linux, WSL)
curl https://cursor.com/install -fsS | bash

# Homebrew (macOS only)
brew install --cask cursor-cli

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The specific use of '| bash' turns downloaded remote content directly into executed shell commands, removing any opportunity for review or integrity checking. In the context of a developer skill intended to be copied and used from documentation, this materially increases the risk of supply-chain compromise and accidental execution of malicious installer logic.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

Install the Cursor CLI:

bash

# Standard installation (macOS, Linux, WSL)
curl https://cursor.com/install -fsS | bash

# Homebrew (macOS only)
brew install --cask cursor-cli

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Using 'curl ... | bash' executes remote script content directly without prior inspection, integrity verification, or pinning. If the remote endpoint, transport, or upstream distribution is compromised, users could immediately execute attacker-controlled code on their machine.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

bash

# Install
curl https://cursor.com/install -fsS | bash

# Login
agent login

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The pipe-to-bash pattern is a classic dangerous command chain because it combines network retrieval and shell execution in one step, eliminating review boundaries. In a skill meant to be followed by operators, this increases the chance of immediate compromise from malicious or tampered installer content.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

bash

# Install
curl https://cursor.com/install -fsS | bash

# Login
agent login

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

agent -p "find and fix all unused imports in src/"

# With specific model
agent -p "review this code for security issues" --model gpt-5.2

# JSON output for parsing
agent -p "list all TODO comments" --output-format json

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

This is a true autonomy-risk issue: the skill explicitly recommends a mode that applies changes with no confirmation. In this skill's context, the agent is intended to edit codebases, so removing confirmation substantially raises the likelihood of unsafe or unintended modifications at scale.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

Streaming JSON (real-time)

agent -p "run tests and report" --output-format stream-json --stream-partial-output

Force mode (auto-apply changes, no confirmation)

agent -p "fix all linting errors" --force

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Documenting '--force' as 'auto-apply changes, no confirmation' encourages unattended file modifications without a prominent warning about review, backups, or repository trust. In a coding-agent skill, this is risky because the agent can make broad changes quickly, potentially damaging code, introducing insecure changes, or modifying sensitive files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The cloud handoff section tells users to send work to Cursor's cloud without warning that prompts, code, secrets, or proprietary project context may be transmitted to a remote service. In the context of a developer skill operating on local repositories, this omission creates real confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The security section materially understates risk by claiming 'No raw shell access by default' even though the documented CLI path explicitly instructs use of terminal exec and also documents sandbox disabling. This can mislead operators into treating the skill as safer than it is, increasing the chance they permit arbitrary code execution or unsafe agent actions in sensitive repositories.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.