Cursor2api Skill Clawhub

This skill appears to do what it says, but exercise caution. Key points to consider before installing or following its instructions: - The runtime relies on a third-party Docker image (waitkafuka/cursor-api:latest) with no source or homepage; pulling/running it may execute arbitrary code. Verify the image source or run it in an isolated VM/container environment. - The instructions require you to extract a session cookie (WorkosCursorSessionToken) from your browser and use it as an API key. That token is highly sensitive: anyone possessing it can access your Cursor account. Avoid storing it in plaintext files or shell rc files; prefer a secure secret store, short-lived tokens, or a dedicated throwaway account if you must test. - The skill metadata does not declare the env vars it actually uses (WORKOS_CURSOR_SESSION_TOKEN, ANTHROPIC_API_KEY). That mismatch is an incoherence—treat the provided metadata as incomplete. - Using a session cookie as an API key and proxying Cursor traffic may violate Cursor's Terms of Service; the docs note ToS risk—review Cursor's policies first. - If you decide to proceed: inspect the Docker image (source repo or image contents), run it on a non-production or isolated host, do not reuse high-privilege credentials, and avoid persisting tokens in plaintext. If you want stronger assurance, ask the skill author for the image repository/source, a reproducible Dockerfile, or a signed release, and for metadata to be updated to declare the required env vars/credentials.