cursor-do

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md の Step 5 で、外部ユーザー入力（$ARGUMENTS/“”）を cursor-companion.sh にそのまま渡して composer-2.5-fast がファイル編集のために取り込むため、アウトサイド著者のテキスト注入がワークフロー内で LLM に読まれる。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires contacting the Cursor backend (network allowlist for *.cursor.sh, e.g. api2.cursor.sh / agentn.global.api5.cursor.sh) at runtime via the cursor-agent/companion to obtain model-driven instructions that can perform file edits, so external domains like *.cursor.sh are a runtime dependency that can control execution.