Yes, not Hurl itself. But Hurl can be used to execute malicious statements.
It is a difference, whether an attacker uses his own IP address (or a setup with various VPNs and proxies) or uses Hurl for it so that the target website sees only Hurl's IP in its logs.
In times of free WiFi, the traceability of malicious requests is definitely reduced anyway, but Hurl could potentially add another layer that can be used by an attacker to obscure his/her origin. I'm not saying that this is a major security issue, it is just a flaw by design, which I wanted to point out.
Hoping that an attacker can't use curl probably isn't a good security solution...