The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates as an orchestration layer that ingests a 'brief' (task instructions) and passes it to a separate agent for implementation, creating an inherent injection surface.
Ingestion points: The instructions are read from stdin or a file in scripts/relay.mjs and provided to the cursor-agent CLI.
Boundary markers: The documentation in references/writing-the-brief.md recommends using XML-like blocks (e.g., <task>, <verification_loop>) to structure instructions, but these are not technical security boundaries.
Capability inventory: scripts/relay.mjs invokes cursor-agent and git via child_process methods. The cursor-agent implementer has the capability to write to the filesystem and execute shell commands (facilitated by the --force flag).
Sanitization: The relay script does not perform content-based sanitization or filtering of the brief text before passing it to the child process.
[COMMAND_EXECUTION]: The scripts/relay.mjs script executes system commands including cursor-agent, git, and taskkill (on Windows) using Node.js child_process functions to manage the implementation lifecycle.
[EXTERNAL_DOWNLOADS]: The documentation directs users to install the cursor-agent CLI from its official domain at cursor.com/cli, which is a well-known service.

cursor-delegate