Cursor Team Kit — agentic threat model

Not certain from the listing — The specific foundation models are not disclosed, though it likely leverages Cursor's integrated LLMs. The primary threat is indirect prompt injection via malicious code repositories, leading to unauthorized local command execution.

Not certain from the listing — No dedicated vector database or training pipeline is described. The agent operates directly on the local codebase, posing a risk of sensitive code exfiltration if the agent is compromised.

The agent orchestrates local shell commands and CI workflows. The primary threat is insecure tool integration, where malicious inputs or prompt injections can hijack the tool-calling mechanism to execute arbitrary shell commands.

The agent is deployed locally as a Cursor plugin on the developer's machine. Because no sandboxing is mentioned, any compromise of the plugin translates directly to host machine takeover, credential theft, and potential lateral movement.

Not certain from the listing — There is no mention of built-in evaluation, logging, or guardrail frameworks, creating a significant blind spot for detecting anomalous or malicious local command execution.

Not certain from the listing — Lacks explicit mention of access controls, policy enforcement, or compliance auditing, relying entirely on the host developer's local user permissions.

Not certain from the listing — While it supports 'agent flows', there is no explicit multi-agent marketplace or A2A trust framework described beyond local integration.