[cute_boi]

I agree cursor can fix the issue, but the main issue is downloading anything from untrusted source. The repo may have AGENTS.md which can tell please install npm package from random repo and run pnpm start etc...

We should never ever download any pdf or excel macros etc.. from untrusted source.

[hnfong]

If we take your logic to the extreme, then there are never any legitimate code execution vulnerabilities in web browsers since the user is not supposed to visit untrusted websites.

[cute_boi]

Correct, we shouldn't visit untrusted website unless it is from trusted source like banks etc.. There is reason why scamming is billion dollar industry.

[iainmerrick]

If you can’t download anything safely, the web can’t exist.