registry / @cursor/sdk / 1.0.22
@cursor/sdk@1.0.22
TypeScript SDK for Cursor agents.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection shows a legitimate Cursor agent SDK: network, env, filesystem, and agent tool primitives are tied to explicit SDK calls and local/cloud agent functionality. There is no consumer install-time execution, foreign AI-agent control-surface write, persistence, credential harvesting, or command-output exfiltration path established.
Static reason
One or more suspicious static signals were detected.
Trigger
User imports the SDK and calls Agent/Cursor APIs.
Impact
Can contact Cursor cloud and maintain local run/checkpoint state when the application opts in; no unconsented lifecycle mutation or credential harvesting found.
Mechanism
User-invoked Cursor agent SDK operations
AI rationale
Static inspection shows a legitimate Cursor agent SDK: network, env, filesystem, and agent tool primitives are tied to explicit SDK calls and local/cloud agent functionality. There is no consumer install-time execution, foreign AI-agent control-surface write, persistence, credential harvesting, or command-output exfiltration path established.
Evidence
package.jsonREADME.mddist/cjs/index.jsdist/esm/index.jsdist/esm/642.jsdist/esm/986.jsdist/esm/400.jsdist/esm/sqlite.jsdist/cjs/sqlite.js
Network endpoints1
cursor.com
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has only prepublishOnly; no install/postinstall hook for consumers.
- Entrypoints are SDK exports in dist/cjs/index.js and dist/esm/index.js, not import-time payload launchers.
- Cloud code in dist/esm/642.js requires explicit apiKey/CURSOR_API_KEY and user API calls for cloud agents.
- Runtime writes are local agent state files such as agents.ndjson, runs.ndjson, run_events.ndjson, checkpoints.ndjson under caller-selected/default state root.
- MCP servers, envVars, artifacts, and prompts are user-supplied SDK options, not harvested automatically.
- dist/esm/sqlite.js child_process/native-loading signals are bundled sqlite/local-runtime support, not lifecycle persistence or exfiltration.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinified
Source & flagged code
6 flaggeddist/esm/sqlite.jsView file
1import*as t from"@bufbuild/protobuf";import*as e from"node:child_process";import*as n from"node:crypto";import*as r from"node:fs";import*as s from"node:fs/promises";import*as o fro...
High
1import*as t from"@bufbuild/protobuf";import*as e from"node:child_process";import*as n from"node:crypto";import*as r from"node:fs";import*as s from"node:fs/promises";import*as o fro...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/esm/sqlite.jsView on unpkg · L1dist/esm/250.jsView file
1/*! For license information please see 250.js.LICENSE.txt */
L2: export const __webpack_esm_id__=250;export const __webpack_esm_ids__=[250];export const __webpack_esm_modules__={"../../node_modules/.pnpm/exif-parser@0.1.12/node_modules/exif-pars...
Findings
6 High3 Medium8 Low
HighChild Processdist/esm/sqlite.js
HighShell
HighSame File Env Network Executiondist/esm/sqlite.js
HighCommand Output Exfiltrationdist/esm/357.js
HighCopied Package Dependency Bridgedist/cjs/sqlite.js
HighOversized Source Filedist/esm/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/esm/250.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @cursor/sdk@1.0.22.
See all versions of @cursor/sdk for other recorded verdicts.
- Review the evidence and your use of @cursor/sdk@1.0.22 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.