The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/relay.mjs executes the cursor-agent and git binaries to perform its tasks. It implements several security best practices to mitigate risk:
Argument Validation: Critical arguments such as model names and session IDs are validated against strict alphanumeric regex patterns (SAFE_MODEL, SAFE_SESSION) to prevent shell injection.
Secure Argument Handling: The script uses platform-specific quoting on Windows to safely handle paths with spaces or special characters when launching the .cmd shim.
Standard Input for Payloads: Task instructions (the 'brief') are passed via stdin rather than command-line arguments, which prevents them from appearing in process lists and avoids OS-level argument size limits.
[INDIRECT_PROMPT_INJECTION]: As a delegation tool, the skill relays natural language instructions to a sub-agent, creating a surface for indirect prompt injection. This risk is addressed through the following architecture:
Ingestion points: User tasks and repository context are formatted into a brief (documented in references/writing-the-brief.md) and processed by scripts/relay.mjs.
Boundary markers: The documentation explicitly guides the orchestrator to use XML-like tags (e.g., <task>, <action_safety>) to separate instructions from data.
Capability inventory: The sub-agent (cursor-agent) has the capability to write files and execute commands within the specified working directory.
Sanitization & Human-in-the-Loop: The skill enforces a 'Review and Land' boundary where the orchestrator is instructed to verify all code changes and re-run local tests before committing any work, ensuring that no malicious code generated by an injected sub-prompt is accepted automatically.

cursor-delegate