Why It Matters

SEC360 flags Cursor rule markdown whose frontmatter sets globs to something other than a YAML sequence of path patterns.

This is useful because:

• Cursor rules are configuration-bearing markdown, not free-form prose
• path targeting becomes harder to review when globs is written as a scalar or malformed inline value
• the failure mode is community-hostile: the rule looks scoped, but loaders may interpret it inconsistently or ignore it

What Triggers

This rule applies only to Cursor rule markdown surfaces such as .mdc and .cursorrules.

It triggers when:

• frontmatter contains globs
• and globs is not a sequence of non-empty string patterns

Examples that trigger:

---
globs: "**/*.rs"
---

---
globs: *
---

Example that stays clean:

---
globs:
  - "**/*.rs"
  - "**/*.toml"
---

• fixture-like paths under tests/, fixtures/, examples/, or samples/

False Positives

This rule now lives in the explicit guidance lane because some repos still carry legacy or compatibility-projection Cursor rule files. The signal is about deterministic config quality and interoperability, not about exploitability.

Remediation

Write globs as an explicit YAML sequence:

---
globs:
  - "**/*.rs"
  - "**/*.toml"
---

If the rule should apply globally, prefer the normal Cursor rule model with alwaysApply: true instead of using malformed or scalar globs syntax.