The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a multi-step delegation pattern by generating a "Mission Packet" that is passed to a downstream agent (Cursor Agent CLI) for execution. This creates a risk where instructions or data processed in the primary session could maliciously influence the sub-agent's behavior.
Ingestion points: User instructions and session context are ingested to generate the Mission Packet described in SKILL.md.
Boundary markers: The skill requires the packet to include "stop conditions," "preserved behavior," "explicit non-goals," and "observable acceptance" criteria to limit the sub-agent's scope.
Capability inventory: The sub-agent invoked via the CLI has capabilities for file system modification, arbitrary command execution, network access, and MCP tool usage (references/cursor-agent-cli.md).
Sanitization: The instructions explicitly forbid placing secrets or hardcoded credentials in the mission packet, recommending references to environment variables instead.
[PRIVILEGE_ESCALATION]: The skill documentation describes the use of high-privilege flags such as --force and --trust. As noted in the references/cursor-agent-cli.md file, the --force flag enables an unattended execution mode that bypasses MCP tool confirmations, trusts the workspace, and enables web tools, effectively removing standard interaction-based safety gates.
[COMMAND_EXECUTION]: The core functionality of the skill relies on invoking the local agent CLI binary using several sub-commands (agent models, agent status, agent --print) to execute the delegated mission.
[EXTERNAL_DOWNLOADS]: The skill references official documentation, changelogs, and tool references hosted on cursor.com. These references target a well-known service associated with the skill's primary functionality.

cursor-cli-delegation