10.3 Cursor Agent SDK Importer & Sanitizer

chinwag agent import-cursor ./cursor-project --name MY-AGENT

PRD Metadata (PRD-0036 / CHWG-0204):

• Status: RATIFIED — SCHEDULED ON BOARD (02 · 📐 SCOPED & BENCHMARKED)
• Live Board Ticket: CHWG-0204 on GitHub Projects v2 (github.com/orgs/emunlabs/projects/1)
• Invariants Enforced: INV-CURSOR-IMPORT-SAFE-01 (a–e) · INV-DESIGN-TYPE-ONLY-01
• Author & Assignee: Brian Spector (Emun Labs, Inc., 1401 Lavaca St STE 81335, Austin, TX 78701) · @RUST · @DELIVERY · @QA

1. Deterministic 1:1 Artifact Translation (<500ms)

Cursor's Agent SDK and Projects format defines agents using five local file artifacts (instructions.md, tools/, skills/, mcp-connections/, channels/), but locks deployment to metered cloud hosting. Running chinwag agent import-cursor <src-dir> --name <NAME> deterministically translates any Cursor agent directory into a local Chinwag SOP-BOOT-01 agent bundle (SOUL.md, AGENT.md, TOOL.md, skills/**/SKILL.md) that runs across all supported frontier and local engines on BYO-Mac hardware at $0/minute:

2. Five-Gate Untrusted Cursor Import Sanitizer (INV-CURSOR-IMPORT-SAFE-01)

Because .cursor/mcp.json, mcp-connections/*.json, and .cursor/rules/*.mdc files are frequently cloned from untrusted third-party repositories where malicious MCP command/args/env entries attempt remote code execution (RCE) or credential exfiltration on first boot, chinwag agent import-cursor enforces five mandatory static security gates:

1. Zero Execution During Import (INV-CURSOR-IMPORT-SAFE-01a): Parses agent.json, instructions.md, .cursor/mcp.json, and .mdc files strictly as inert AST data; never invokes node, bun, npx, uvx, sh, or bash during import.
2. MCP Command & Shell-Metacharacter Quarantine (INV-CURSOR-IMPORT-SAFE-01b): Validates every MCP server executable against a strict allowlist (npx, uvx, docker, or /nix/store paths with zero .. traversal). Any command or args containing shell interpreters (sh -c, bash -c, eval, curl | sh), command substitution (`, $(, ;, &&, |), or remote URL package specifiers is hard-rejected with exit code 78 (EX_CONFIG).
3. Dynamic Linker & Runtime Environment Scrubbing (INV-CURSOR-IMPORT-SAFE-01c): Strips code-injection environment variables (DYLD_INSERT_LIBRARIES, DYLD_LIBRARY_PATH, LD_PRELOAD, NODE_OPTIONS, PYTHONSTARTUP, PYTHONPATH, BASH_ENV, GIT_SSH_COMMAND, CARGO_BUILD_RUSTC_WRAPPER) from any imported env block.
4. Automatic Secret Scrubbing & PhantomVault Conversion (INV-CURSOR-IMPORT-SAFE-01d): Replaces any inline high-entropy credential (sk-*, ghp_*, github_pat_*, xoxb-*, AKIA*, Bearer *) with a chwg_phantom_<sha256_prefix> handle backed by the macOS Keychain.
5. Prompt-Injection & Exfiltration Directive Scanner (INV-CURSOR-IMPORT-SAFE-01e): Scans .cursor/rules/*.mdc and instructions.md for hidden Unicode bidi/tag characters (U+202A–U+202E, U+2066–U+2069, U+E0000–U+E007F), base64 shell payloads, and forbidden credential paths (~/.ssh, ~/.aws, /etc/passwd), aborting import on any match.

• Ready to ship verified code at autonomous speed? Reserve Your Organization Credit Pack →