The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill executes multiple shell scripts from resolved plugin paths and repository-specific validation scripts located in the worktree. Specifically, Step 6 instructs the agent to execute tests/test-support-claim-wording.sh and scripts/ci/check-consistency.sh inside the worktree modified by the external service. Since the external AI tool (Cursor) has write access to these scripts, it could potentially inject malicious code into them, which the lead agent then executes during the validation phase.
[PROMPT_INJECTION]: The skill accepts user-provided task descriptions through the $ARGUMENTS variable, which are then passed to an external AI service. This creates an entry point for instructions meant to bypass safety filters or influence the behavior of the external AI.
[DATA_EXPOSURE]: The skill reads and processes local files, git history, and metadata to manage tasks and reviews. The documentation in references/cursor-cli-only.md emphasizes the use of .cursorignore to prevent unauthorized access to sensitive data by the external service.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted output from an external AI model, creating a potential attack surface.
Ingestion points: User-provided task descriptions and file modifications produced by the Cursor service.
Boundary markers: The process enforces the use of an isolated git worktree and a mandatory manual diff review before merging changes.
Capability inventory: The skill has access to Bash, Read, and Write tools, allowing for command execution and file manipulation.
Sanitization: The security model relies on human-in-the-loop review of diffs rather than automated sanitization of generated code.

cursor-do