[lemagedurage]

The problem seems to be deeper rooted. Cursor doesn't see cloning a repo with Cursor and code execution as separate security boundaries.

Cursor ships with Workspace Trust disabled by default [0]. A repo that includes .vscode/tasks.json with "runOn": "folderOpen" will already run arbitrary code [1].

[0] https://cursor.com/docs/agent/security#workspace-trust

[1] https://www.oasis.security/blog/cursor-security-flaw