The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/run-cursor-subagent.sh executes cursor-agent or agent binaries found in the system PATH. While this is the intended purpose, it grants the skill the ability to spawn external processes with significant privileges.
[COMMAND_EXECUTION]: The skill uses !command style evaluation (via the Preamble section) to check the environment. Specifically, it executes git -C "$WORKSPACE" rev-parse and git -C "$WORKSPACE" status. If $WORKSPACE were maliciously crafted (e.g., through a prompt injection that changes the environment variable), it could lead to unexpected command execution behavior.
[COMMAND_EXECUTION]: The wrapper script uses grep -F "$model" and other shell utilities to validate input. Although the script uses set -euo pipefail and quotes variables, the core functionality is centered around executing a powerful CLI tool (cursor-agent) that has its own workspace permissions and auth state.
[COMMAND_EXECUTION]: The wrapper explicitly disables sandbox mode for the sub-agent using the --sandbox disabled flag when calling cursor-agent. This increases the risk if the sub-agent is compromised or receives malicious instructions, as it will run without the CLI's native isolation layers.

cursor-subagent