Fix instruction file tells the agent to bypass its own controls in Cursor

An instruction file matches one of a small, enumerated set of shapes: disregarding prior instructions, skipping the permission prompt, exfiltrating credentials, or fetching and executing remote content. A heuristic over prose - it runs in `deep`, not in `quick`, and it can never exceed `possible`.

medium possible Cursor CWE-77 / ASI ASI01

The vulnerable pattern in Cursor

This finding comes from the Cursor fixture in the owlwarden test suite. This file is loaded into the model's context as authoritative. Text that asks it to override the instructions above it is not a project instruction; it is an attempt to reach past whoever reviewed this file.

The corrected configuration

Remove it from `.cursorrules` or `.cursor/rules/**`. Cursor loads rules files verbatim, so a sentence like this is competing with the developer's own instructions on equal terms.

// .cursor/rules/project.mdc - project facts only

If you are not using Cursor

Delete the sentence. If it was written in good faith - a shortcut for a noisy prompt - say what the project actually needs instead: which commands are safe to run, which directories to leave alone. An instruction file should describe the project, never the agent's own controls.

Check your own repository

npx owlwarden scan
npx owlwarden explain agent-instructions-directive

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Cursor checks

Rules with a tested Cursor example.

• agent-config-env-redirect high Repository config redirects the agent's API traffic
• agent-config-loader-script high Executable script inside an agent or editor config directory
• agent-config-secret-reachable high Repository config puts credentials in reach of a repository-controlled command
• agent-hook-autoexec high Repository config executes a command when the workspace is opened
• agent-hook-untrusted-command high Hook command reaches outside the project
• agent-marketplace-untrusted medium Repository config adds a third-party plugin or skill source
• agent-mcp-unpinned-remote medium MCP server declaration resolves code at run time
• agent-permission-wildcard medium Repository config pre-approves a broad tool permission

agent-instructions-directive for every agent host / All rules / owlwarden