poteto-mode

This fragment is security documentation and role configuration, not executable malware, and it shows no credential values or suspicious hardcoded destination. It documents significant execution and isolation risks in the described runners, especially Cursor's npx-launched repository language server and host/repository plugins or hooks that can run as the user or alter permissions. It also describes prompts and tool data being sent to providers, including Amp threads on ampcode[.]com, and local credential/state paths such as ~/.local/share/opencode/auth.json and ~/.dsh/.credentials.yaml. Severity is moderate to high when these runners operate on untrusted repositories or hosts; the fragment itself provides no evidence of malicious intent.

This fragment is a Cursor CLI adapter, not an evident malware payload: it parses CLI output and configures a nominally sandboxed, read-only run without directly exfiltrating data or executing dynamic code. Its documentation nevertheless identifies material execution and credential-exposure risks in the launched CLI: repository configuration and hooks may bypass the intended restrictions, and an `npx` language-server process may execute repository code with `CURSOR_API_KEY` or `CURSOR_AUTH_TOKEN` in its environment. Security risk is elevated for untrusted repositories; no suspicious domain, URL, or IP is present in this code.