cursor-headless
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The documentation includes a command to fetch and execute an installation script from cursor.com via 'curl https://cursor.com/install -fsS | bash'. This targets the official domain of a well-known AI development tool.
- [COMMAND_EXECUTION]: The skill provides instructions for running 'cursor-agent' in a headless environment, specifically recommending flags like '--sandbox disabled', '--trust', and '--auto-review'. These flags are documented as necessary for programmatic use of this tool to bypass interactive prompts and environment-specific sandbox constraints.
- [INDIRECT_PROMPT_INJECTION]: The skill describes how to pass arbitrary text prompts to the 'cursor-agent' CLI. This creates a surface for indirect prompt injection, particularly when the agent is configured to run with its sandbox disabled and auto-review enabled.
- Ingestion points: The '' and stdin inputs to the 'cursor-agent -p' command in 'SKILL.md'.
- Boundary markers: None explicitly mentioned for isolating untrusted input within the CLI command string.
- Capability inventory: The documentation describes the agent's ability to execute shell commands, perform MCP tool calls, and fetch web content (managed via '.cursor/cli.json').
- Sanitization: No specific sanitization or escaping mechanisms for the task input are discussed in the documentation.
Audit Metadata