cursor-agent-development

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt contains explicit examples that pass API keys as command-line arguments (agent --api-key "your-api-key") and in config headers, which would require the LLM to emit secret values verbatim in commands/configs, creating exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly enables fetching and interpreting public third‑party content—e.g., "Browser Automation" in reference/advanced-features.md (“Page analysis and extraction”) and MCP integration in reference/mcp-integration.md (external MCP URLs like https://mcp.context7.com and GitHub tools)—which instructs the agent to query and act on external, user-generated/public web sources.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill documents MCP server entries that the agent will contact at runtime (e.g., "https://mcp.context7.com/mcp") and shows command-based MCP servers that run npx (e.g., "npx -y @modelcontextprotocol/server-filesystem" and "npx -y @modelcontextprotocol/server-github"), which fetch and execute remote code and expose tools/contexts that directly affect agent behavior.