cursor-sdk
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a technical reference for the
@cursor/sdkTypeScript library. It provides legitimate implementation patterns for agent creation, error handling, and runtime configuration without introducing malicious instructions. - [DATA_EXPOSURE_AND_EXFILTRATION]: The documentation correctly advises using
process.env.CURSOR_API_KEYfor authentication. This follows industry-standard security practices for credential management and avoids the risk of hardcoded secrets. - [INDIRECT_PROMPT_INJECTION]: The skill documents an interface for agents to process repository content and user-supplied prompts. While this creates a surface for indirect prompt injection at the application level, the skill itself does not contain malicious payloads and provides structural patterns to handle these interactions safely.
- [COMMAND_EXECUTION]: The code examples provided demonstrate legitimate use of the Cursor SDK to perform automated coding tasks. The operations are scoped to the developer's local environment or explicit cloud repositories as per the user's intent.
Audit Metadata