.cursor— mcp server

.cursor — independently scanned and version-tracked by SaferSkills.

by jabrena·MCP Server·github.com/jabrena/cursor-rules-java

Is .cursor safe to install?

SaferSkills independently audited .cursor (MCP Server) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

Score
92/100
●●●●●●●●●○
Re-scan~30s
Latest scan
ScannedJun 23, 2026 · 129d ago
Scans run0 over 90 days
Detectors55 checks · 5 categories
Findings2 warnings · 0 high
EngineSaferSkills 755a9a5
View methodology →
SaferSkills installs
This week0
This month0
All time0
CategoryWeightCategory scoreContribution
Securityprompt, exec, net, exfil, eval
35%
76
26.6 pts
Supply chainhash, typosquat, maintainer, lockfile
20%
100
20.0 pts
Maintenancestaleness, pinning, CI
15%
100
15.0 pts
TransparencySKILL.md, perms, README
15%
100
15.0 pts
Communityinstalls, verify, response
15%
100
15.0 pts

Findings & checks · 2 flagged

Securityscore 76 · 2 findings
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · .cursor/commands/create-acceptance-criteria.md
MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerpt.cursor/commands/create-acceptance-criteria.md· markdown
52- Confirm actors, desired outcomes, business rules, shared terminology, conflicts, and unres
… (66 chars elided on L52)
53- Develop supported main, alternative, boundary, and error examples where relevant, then for
… (69 chars elided on L53)
54- Do not ask the user to restate facts already established in the Functional Specification.
55- When a missing, ambiguous, or conflicting behavior fact would materially change a scenario
… (105 chars elided on L55)
566. Assemble one common Markdown source for every supported tracker using exactly this struct
… (4 chars elided on L56)
Occurrences
1 occurrence · at L54
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484a…rubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · .cursor/commands/explore-problem.md
MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerpt.cursor/commands/explore-problem.md· markdown
514. Apply the five lenses in the fixed sequential order `021-problem-framing` -> `022-root-ca
… (108 chars elided on L51)
52- Evaluate the directly-read issue content (and any prior User Story) against that lens's re
… (14 chars elided on L52)
53- Ask clarifying questions for that lens only when its content is vague, ambiguous, or uncle
… (105 chars elided on L53)
54- Wait for the user's answer before proceeding.
55- Write that lens's Functional Specification section using only the issue content and the us
… (86 chars elided on L55)
Occurrences
1 occurrence · at L53
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25612211d7a427c799a…rubric 365aacaView on GitHub
Supply chainscore 100 · 0 findings
✓—All supply chain checks passedNo findings in this category for the latest scan.pass
Maintenancescore 100 · 0 findings
✓—All maintenance checks passedNo findings in this category for the latest scan.pass
Transparencyscore 100 · 0 findings
✓—All transparency checks passedNo findings in this category for the latest scan.pass
Communityscore 100 · 0 findings
✓—All community checks passedNo findings in this category for the latest scan.pass
Vendor response · right of reply
Are you the maintainer? Submit a response →

Audit the pieces. Scan the whole. Decide.

~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.