composer
Fail
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: Orchestrates the
agentorcursor-agentCLI through shell wrappers (bin/composer-run.sh,bin/cursor-agent-doctor.sh) to automate AI-driven development tasks. - [DATA_EXFILTRATION]: Accesses environment variables and local
.envfiles to retrieveCURSOR_API_KEY. It implements redaction logic inbin/cursor-agent-lib.shto prevent these credentials from appearing in command output or logs. - [PROMPT_INJECTION]: The skill processes untrusted external data which serves as a surface for indirect prompt injection.
- Ingestion points: Ingests git diffs and PR patches in
review.mdand natural language implementation briefs ingenerate.md. - Boundary markers: Lacks explicit delimiters or instructions to ignore malicious commands embedded in the processed diffs or briefs.
- Capability inventory: Executes shell commands, performs file system writes, and manages git repositories via the wrapped agent.
- Sanitization: Does not perform sanitization or validation of the content of ingested diffs or briefs before passing them to the AI agent.
- [EXTERNAL_DOWNLOADS]: Recommends the installation of the Cursor Agent CLI using a script from the well-known service
cursor.com(curl https://cursor.com/install -fsS | bash).
Recommendations
- HIGH: Downloads and executes remote code from: https://cursor.com/install - DO NOT USE without thorough review
Audit Metadata