ai-soc-agent

The `_run_cursor_agent` function in `src/ai_controller/agent_executor.py` executes an external `cursor-agent` command using `subprocess.run` with `prompt_text` directly included in the arguments. If `prompt_text` can be influenced by untrusted input, this poses a severe command injection vulnerability. While the system typically generates prompts internally, any exposure to external users could be critical. Additionally, the `ElasticSIEMClient` allows passing raw Elasticsearch Query DSL, which, if not properly validated by the underlying Elasticsearch API, could lead to powerful but potentially malicious queries (e.g., data exfiltration, denial of service). The system also handles various API keys and tokens for numerous integrations, necessitating robust secrets management.