ClawHub
Back to skill

Security audit

Cursor Rules

Security checks for vulnerabilities and agentic risk

Overview

This is a Cursor IDE guidance skill with disclosed developer-tool advice, but users should be careful with its Agent/yolo mode and MCP examples.

Install only if you want Chinese Cursor IDE guidance. Before copying the MCP examples, pin package versions where possible, use the narrowest filesystem path, keep GitHub tokens out of committed config, and avoid yolo mode except in disposable or sandboxed projects.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:100
Finding

Unpinned npm Packages Executed Automatically by MCP Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 100–110
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

json
{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/path/to/dir"]
    },
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": { "GITHUB_TOKEN": "ghp_xxx" }
    }
  }
}

Technical Analysis

The example invokes two npm packages through npx -y without pinning exact package versions or enforcing package integrity. The -y option suppresses the installation confirmation, while the absence of version constraints allows npm registry resolution to select package code at execution time.

If a package release, maintainer account, registry response, or transitive dependency is compromised, users who copy this configuration could execute attacker-controlled code under their local account. The effective executable may change after the Skill has been reviewed because the executable packages are not included in the audited project.

The ghp_xxx value is a placeholder and is not an exposed credential. Nevertheless, the GitHub MCP process would receive any real token substituted by the user, and the filesystem process would receive access to the configured directory.

Attack Path

  1. A user copies the documented MCP configuration into .cursor/mcp.json.
  2. The user replaces the placeholder path or token with operational values.
  3. Cursor launches the configured server using npx -y.
  4. npm resolves and, when necessary, downloads the unpinned package and its dependency tree.
  5. A compromised resolved package executes with the privileges of the Cursor user.
  6. The malicious process accesses files under the configured filesystem path or reads the GitHub token supplied to its environment.
  7. It may then modify accessible files, misuse the token within its grante ...[truncated 591 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin every MCP package to an exact, reviewed version rather than relying on registry-selected versions.
  • Install approved dependencies explicitly and retain a lockfile with integrity hashes where the deployment model permits it.
  • Avoid npx -y for security-sensitive integrations; require an explicit review or approval step before installation and first execution.
  • Verify package provenance, maintainers, release signatures or attestations, and integrity before deployment.
  • Prefer a controlled internal registry or allowlisted artifact repository for MCP server packages.
  • Run MCP servers in a sandbox or container with restricted filesystem and network permissions.
  • Replace /path/to/dir with the narrowest required directory rather than a home directory or project collection.
  • Use a dedicated, short-lived GitHub token with only the minimum repository and operation scopes required.
  • Keep secrets outside committed configuration files and inject them through an approved secret-management mechanism.
  • Periodically re-review pinned updates and monitor package advisories before upgrading.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description and main instructions present the assistant entirely in Chinese and instruct the agent as '你是一个…AI 助手' without any opt-in or note about language preference. This can violate language/locale policy because it imposes a specific language rather than offering the user a choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly promotes Agent mode and yolo mode that can create/edit files and run terminal commands, but the overview does not place a prominent safety warning beside those capabilities. In a developer-tools skill for an IDE agent, this increases the chance that users enable autonomous command execution without understanding the risk of destructive file changes, dependency/script execution, or shell misuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.