cursor-cli-delegation
Warn
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to invoke the 'cursor-agent' CLI using the '--yolo' (or '--force') flag. This flag enables 'broad unattended command/tool approval,' which allows the sub-agent to execute arbitrary shell commands and tool calls autonomously within the specified workspace. The skill provides a Bash implementation to search for the executable on the PATH, which facilitates this autonomous execution.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection by relaying user-supplied instructions to an autonomous sub-agent.
- Ingestion points: The 'packet' variable (populated from 'packet_path' or direct task input) serves as the instruction set for the Cursor CLI sub-agent.
- Boundary markers: The skill includes narrative instructions to treat external data as 'task data' rather than 'new instructions,' but it does not implement technical delimiters or automated sanitization for the content passed to the sub-agent.
- Capability inventory: The sub-agent has full command execution and file-system write access via the '--yolo' mode.
- Sanitization: The instructions suggest quoting variables to prevent shell interpolation but do not include content-level sanitization or filtering of the task instructions before they are passed to the CLI.
- [CREDENTIALS_UNSAFE]: The skill explicitly warns that positional CLI arguments, which include the task prompt, may be visible to other users or processes on the host through process inspection (e.g., via 'ps' or system logs). While the skill advises the agent to keep prompts 'secret-free,' this mechanism represents a potential exposure vector for sensitive information if instructions or task data contain credentials.
- [EXTERNAL_DOWNLOADS]: The reference materials point to official documentation at 'cursor.com' (e.g., 'cursor.com/docs/cli/headless'). These are well-known resources for the Cursor tool and are documented neutrally for the purpose of retrieving CLI parameters and configuration details.
Audit Metadata