lintai docs

Appearance

Rule Reference

SEC379lintai-ai-securitypreviewmarkdownwarn

Cursor rule: unknown frontmatter key

Cursor rule frontmatter contains an unknown key

Provider
lintai-ai-security
Surface
markdown
Scope
per_file
Tier
preview
Severity
warn
Confidence
high
Detection
structural
Remediation
message_only

Activation Model

Preset Membership

This rule is part of the builtin activation graph through these preset memberships.

previewmembership
skillsmembership

Lifecycle

Preview Lifecycle Contract

State

preview_blocked

Promotion blocker

Unknown Cursor rule frontmatter keys are deterministic, but the first release stays guidance-only while ecosystem usefulness is measured.

Promotion requirements

Needs corpus-backed precision review, external usefulness evidence, and completed stable checklist metadata.

Canonical note

Structural preview rule; deterministic today, but the preview contract may still evolve.

Nearby Signals

Related Rules

SEC101HTML comment: dangerous instructionsHidden HTML comment contains dangerous agent instructionsmarkdownpreview
SEC102Markdown: remote execution instructionMarkdown contains remote download-and-execute instruction outside code blocksmarkdownpreview
SEC103HTML comment: remote execution instructionHidden HTML comment contains remote download-and-execute instructionmarkdownpreview
SEC104Markdown: base64 executable payloadMarkdown contains a base64-decoded executable payload outside code blocksmarkdownpreview
SEC105Markdown: parent-directory file accessMarkdown instructions reference parent-directory traversal for file accessmarkdownpreview
SEC313Shell example: remote content piped to shellFenced shell example pipes remote content directly into a shellmarkdownpreview

SEC379 / CURSOR-UNKNOWN-FRONTMATTER ​

SEC379 flags Cursor rule markdown when frontmatter contains keys outside the supported Cursor rule set.

Why It Matters ​

Unknown keys make shared .mdc rules harder to review and can create a false impression that the editor will honor extra routing or policy fields. Community-facing rule packs benefit from a tight, predictable frontmatter contract.

Trigger Shape ​

The rule triggers only when all of these are true:

  • the file is a detected Cursor rule surface
  • frontmatter parses as a mapping
  • at least one top-level key is not one of:
    • description
    • globs
    • alwaysApply

Clean Cases ​

These stay clean:

  • rules that use only supported keys
  • rules with no unknown frontmatter keys
  • fixture-like examples under test or fixture paths

Example Trigger ​

md
---
description: Review guidance
inclusion: always
---

Safer Example ​

md
---
description: Review guidance
alwaysApply: true
---

How To Fix ​

Remove unsupported frontmatter keys, or migrate the intent into supported Cursor rule fields and normal markdown content. Keep routing and policy data out of .mdc frontmatter unless Cursor documents it as a supported field.