The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions for the Cursor CLI include fetching and executing a shell script directly from a remote URL (https://cursor.com/install) via a pipe to bash. While this is a common installation pattern for this well-known service, it is a remote code execution vector.
[COMMAND_EXECUTION]: The core functionality of the skill is to run the Cursor agent using terminal-based automation tools. This allows the agent to execute shell commands, manage git workflows, and interact with the filesystem.
[PROMPT_INJECTION]: The skill processes untrusted external data, such as GitHub issues and project files (including .cursor/rules, AGENTS.md, and mcp.json), which may contain malicious instructions. Since the skill has the capability to execute commands in a terminal session, this creates a surface for indirect prompt injection.
Ingestion points: Reads GitHub issue details, project source code, and configuration files like AGENTS.md and mcp.json (SKILL.md).
Boundary markers: None specified in the instructions for isolating untrusted data.
Capability inventory: Execution of arbitrary shell commands via the cursor_agent_run tool and terminal sessions (SKILL.md).
Sanitization: No evidence of sanitization or validation of the ingested data before it is processed by the AI agent.
[DATA_EXFILTRATION]: The setup instructions include modifying user shell profiles (~/.zshrc or ~/.bashrc) to add new directories to the system PATH. While this is a standard persistence mechanism for CLI tool installation, it involves modifying sensitive configuration files.

cursor-agent