cursor-coding-agent
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to invoke the Cursor CLI (referred to as a launcher) to perform coding tasks. This involves executing shell commands with flags such as
--trust,--force, and--yolo, which grant significant capabilities over the workspace and shell environment. - [INDIRECT_PROMPT_INJECTION]: The skill acts as a proxy for a "task" string which is passed to the Cursor execution engine. This creates a vulnerability surface where untrusted input could contain instructions designed to subvert the agent's constraints.
- Ingestion points: In
SKILL.md, user-defined tasks are passed as arguments to the<launcher>command. - Boundary markers: Instructions rely on standard shell quoting (double quotes) but do not provide explicit delimiters or warnings for the agent to ignore instructions embedded within the task data.
- Capability inventory: The skill enables broad capabilities including file system writes, git operations, and shell command execution via the external CLI.
- Sanitization: There are no specified sanitization routines or validation checks for the content of the task string before it is processed.
Audit Metadata