The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill manages highly sensitive credentials including CURSOR_API_KEY and ZAI_API_KEY by reading them from environment variables and specific filesystem paths, such as repo-local .env files and the machine-wide ~/.cursor/subagents/.env directory. While it includes warnings against logging these keys, the handling of plaintext secrets in standard locations is a risk factor.- [EXTERNAL_DOWNLOADS]: The instructions require the execution of external installation scripts such as scripts/install-nats-server.sh and scripts/install-nats-server.ps1, as well as installing Python dependencies via pip install -e .. These scripts and packages are not provided in the skill bundle and their contents are unverifiable.- [COMMAND_EXECUTION]: The skill performs extensive command-line operations, including starting and stopping system daemons using the cursor-subagent bus and daemon commands, and building a Rust gateway from source using cargo build. It also provides a framework for spawning sub-agents that can execute arbitrary implementation tasks.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from external sources including webhook payloads and repository content. Ingestion points include the --payload argument in the automation trigger command and repository files at the --cwd path. While the skill uses boundary markers like Automation History and Automation Memory Update sections, sub-agents possess broad capabilities to modify files and run tasks, which could be exploited by malicious data.

cursor-subagent