The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill implements a 'Development Mode' via the CURSOR_DOCS_DEV_ROOT environment variable in scripts/utils/dev_mode.py and scripts/bootstrap.py. This mechanism allows the agent to redirect all script execution and configuration paths to an arbitrary directory, effectively allowing the execution of logic from a computed path.
[REMOTE_CODE_EXECUTION]: The scripts/utils/script_utils.py file contains an ensure_yaml_installed function that executes pip install pyyaml using subprocess.check_call. While targeting a specific package, this pattern of automatic package installation at runtime is a risk factor for dependency-based attacks.
[COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run and subprocess.check_call across several files, including scripts/management/refresh_index.py, cursor_docs_api.py, and scripts/utils/script_utils.py. These scripts execute shell commands to orchestrate index rebuilding, metadata extraction, and report generation.
[EXTERNAL_DOWNLOADS]: The scripts/core/scrape_docs.py script is designed to fetch documentation from external URLs, specifically targeting https://cursor.com/llms.txt. While this matches the skill's primary purpose, it establishes a functional path for downloading external content.
[PROMPT_INJECTION]: The SKILL.md file contains instructions using high-priority markers such as 'CRITICAL: Path Doubling Prevention
MANDATORY' and 'ABSOLUTE PROHIBITION'. These attempt to strictly override agent behavior regarding command chaining and file access.
[INDIRECT_PROMPT_INJECTION]: A significant attack surface for indirect prompt injection exists because the skill ingests untrusted data from external websites via scraping (scripts/core/scrape_docs.py) and possesses high-privilege capabilities including filesystem writes and shell execution. An attacker controlling a documentation source could embed instructions designed to manipulate the agent during the scraping or indexing phase.
Ingestion points: scripts/core/scrape_docs.py fetches content from external URLs.
Boundary markers: Absent; the scraped content is processed and stored without explicit delimiters or 'ignore' warnings for the processing agent.
Capability inventory: Subprocess execution, filesystem writes, and network access via requests are present.
Sanitization: Content is converted from HTML to Markdown, but no safety-specific sanitization against prompt injection is implemented.

cursor-docs