registry / AI-agent control-surface risk / cursor-browser-cli
cursor-browser-cli
CLI + MCP to drive Cursor IDE's built-in Browser Tab from Grok Build, Claude Code, Codex, or shell
This report shows the evidence for cursor-browser-cli@1.2.2. 4 of 4 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package’s postinstall mutates broad, foreign AI-agent control surfaces and registers an MCP integration without consent. Localhost-only networking does not mitigate this install-time control-surface change.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm postinstall
Impact
Unconsented installation expands AI-agent control surfaces and browser-automation capability.
Mechanism
automatic multi-agent skill deployment and MCP registration
Policy narrative
On npm installation, setup creates skill directories under multiple unrelated agent products, copies its skill file, and, if present, removes and adds a Grok MCP configuration that launches package code. This occurs without an explicit user setup command. The resulting server provides browser automation via a local Cursor extension.
AI rationale
The package’s postinstall mutates broad, foreign AI-agent control surfaces and registers an MCP integration without consent. Localhost-only networking does not mitigate this install-time control-surface change.
Evidence
package.jsonscripts/setup.jsskill/SKILL.mdmcp/server.mjsextension/extension.js
Network endpoints1
127.0.0.1
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- postinstall runs setup automatically.
- Setup copies a skill into Codex, Claude, Grok, Cursor, and generic agent roots.
- Setup invokes Grok MCP removal/addition without user action.
- Installed extension exposes browser automation through a localhost bridge.
Evidence against
- MCP network client targets only 127.0.0.1.
- No remote endpoint or credential-exfiltration code found in inspected sources.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/setup.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgscripts/setup.jsView file
48function copyFile(src, dest) {
L49: fs.mkdirSync(path.dirname(dest), { recursive: true });
L50: fs.copyFileSync(src, dest);
L51: }
...
L92: fs.rmSync(target, { recursive: true, force: true });
L93: fs.mkdirSync(target, { recursive: true });
L94: for (const f of files) {
...
L108: path.join(os.homedir(), ".grok", "skills", "cursor-browser"),
L109: path.join(os.homedir(), ".claude", "skills", "cursor-browser"),
L110: path.join(os.homedir(), ".agents", "skills", "cursor-browser"),
L111: path.join(os.homedir(), ".cursor", "skills", "cursor-browser"),
L112: path.join(os.homedir(), ".codex", "skills", "cursor-browser"),
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/setup.jsView on unpkg · L48scripts/install.sh
Findings
1 Critical2 High4 Medium5 Low
CriticalAi Agent Control Hijackscripts/setup.js
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritymcp/server.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/install.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to cursor-browser-cli@1.2.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing cursor-browser-cli@1.2.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
4 known versions1.2.2latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 12, 2026, 6:08 PM1.2.0MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 10, 2026, 10:04 PM1.1.1MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 10, 2026, 5:24 PM1.0.0MaliciousSoft block: AI-agent control surfaceBlockPublished