Create Plugin (Cursor) — agentic threat model

Not certain from the listing — The underlying LLM used by Cursor to drive the scaffolding commands is not specified. Standard threats like prompt injection could theoretically force the agent to generate malicious boilerplate code or invalid manifests.

The agent reads local workspace files, specifically manifest files and component paths, to perform validation. Risks include path traversal or reading sensitive workspace files if validation inputs are manipulated.

The agent orchestrates file writing and validation commands. Insecure tool integration is a risk if the scaffolding tool can be coerced into writing files outside the designated target directory.

Runs locally as a Cursor IDE plugin. The primary threat is local privilege escalation or arbitrary file writes within the user's local workspace, potentially leading to local code execution if malicious files are scaffolded.

Not certain from the listing — There is no mention of built-in logging, guardrails, or telemetry to monitor the scaffolding and validation actions for anomalous behavior.

The agent is open source and free, but lacks explicit mention of security audits, sandboxing, or strict access control policies governing which workspace directories it is allowed to modify.

The agent produces plugins conforming to the Cursor specification, which may be published to a wider ecosystem. Compromise of this agent could lead to the creation and distribution of supply-chain style malicious plugins.