cursor-headless

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The documentation includes a command to fetch and execute an installation script from cursor.com via 'curl https://cursor.com/install -fsS | bash'. This targets the official domain of a well-known AI development tool.
  • [COMMAND_EXECUTION]: The skill provides instructions for running 'cursor-agent' in a headless environment, specifically recommending flags like '--sandbox disabled', '--trust', and '--auto-review'. These flags are documented as necessary for programmatic use of this tool to bypass interactive prompts and environment-specific sandbox constraints.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes how to pass arbitrary text prompts to the 'cursor-agent' CLI. This creates a surface for indirect prompt injection, particularly when the agent is configured to run with its sandbox disabled and auto-review enabled.
  • Ingestion points: The '' and stdin inputs to the 'cursor-agent -p' command in 'SKILL.md'.
  • Boundary markers: None explicitly mentioned for isolating untrusted input within the CLI command string.
  • Capability inventory: The documentation describes the agent's ability to execute shell commands, perform MCP tool calls, and fetch web content (managed via '.cursor/cli.json').
  • Sanitization: No specific sanitization or escaping mechanisms for the task input are discussed in the documentation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 10:22 AM
Security Audit — agent-trust-hub — cursor-headless