cursor-agent
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEPERSISTENCEEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [PERSISTENCE]: The skill includes instructions for optional shell integration that modifies the user's
~/.zshrcfile to register the CLI binary or shell completions. - [EXTERNAL_DOWNLOADS]: The skill directs the agent to download and run an installer from
https://cursor.com/install, which is the official site for the Cursor technology service. - [PRIVILEGE_ESCALATION]: The skill documents powerful tool capabilities including
--computer-usefor desktop control and--approve-mcpsfor bypassing individual server approvals, noting that these require named waivers. - [CREDENTIALS_UNSAFE]: The skill handles authentication state and tokens, including flags for OIDC token minting and GitHub token injection, though it provides explicit instructions to redact secrets and prefer environment variables over CLI arguments.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external workspace data and user prompts to interact with the CLI agent, creating a vulnerability surface for indirect injection from untrusted codebases. Ingestion points: Workspace files and repository trees. Boundary markers: Prompt literals are quoted. Capability inventory: Executes shell commands via the
cursor-agentbinary and performs file writes for configuration. Sanitization: Explicit instructions to redact account dumps and tokens from outcome evidence.
Audit Metadata