Security audit

Cursor2api Skill Clawhub

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly about running a Cursor API proxy, but it asks users to reuse a sensitive browser session token in ways that are under-secured.

Review before installing. Use only if you accept giving a third-party proxy container your Cursor session cookie and routing prompts through it. Prefer a pinned image digest, loopback-only port binding, HTTPS or an SSH/VPN tunnel for any remote access, and a secret manager or locked-down env file instead of shell history, shell rc files, or command-line token arguments. Rotate the Cursor session token if it has been pasted into shared files, logs, screenshots, or command history.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: scripts/refresh-token.sh:21
Finding: Mutable Third-Party Container Image Receives Sensitive Credentials and AI Traffic
Content: View full analysis
Remediation: View remediation
``` 2. Publish or link the exact source revision used to build the image and provide reproducible build instructions. 3. Verify the image with a trusted signing mechanism such as Sigstore/Cosign before execution. 4. Use an automated dependency-review process that detects digest changes and requires a new security assessment. 5. Run the container as a non-root user with: - A read-only root filesystem. - Dropped Linux capabilities. - `no-new-privileges`. - Explicit CPU and memory limits. - Restricted outbound network access. 6. Avoid passing the primary account session cookie to an unaudited component. Prefer a scoped, revocable credential intended specifically for proxy/API use. 7. Document the exact image version and expected digest instead of recommending `latest`. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/refresh-token.sh:5
Finding: Cursor Session Token Exposed Through Command Arguments, Shell Files, and Container Environment
Content: View full analysis
set -e CONTAINER_NAME="cursor-api" CONTAINER_PORT="3010" NEW_TOKEN="$1" if [ -z "$NEW_TOKEN" ]; then echo "❌ Usage: ./refresh-token.sh " echo " Example: ./refresh-token.sh 'eyJhbGciOiJS...' " exit 1 fi echo "🔄 Stopping existing container..." docker stop $CONTAINER_NAME 2>/dev/null || true docker rm $CONTAINER_NAME 2>/dev/null || true echo "🚀 Starting new container..." docker run -d \ --name $CONTAINER_NAME \ -p ${CONTAINER_PORT}:3000 \ -e WORKOS_CURSOR_SESSION_TOKEN="$NEW_TOKEN" \ waitkafuka/cursor-api:latest ``` The configuration guide also recommends persistent plaintext storage: ```bash export ANTHROPIC_BASE_URL="http://localhost:3010/v1" export ANTHROPIC_API_KEY="your_workos_cursor_session_token" export ANTHROPIC_DEFAULT_SONNET_MODEL="claude-sonnet-4-6" ``` ```bash CURSOR_API_URL="http://localhost:3010/v1" CURSOR_TOKEN="your_workos_cursor_session_token" CURSOR_MODEL="claude-sonnet-4-6" ``` ### Technical Analysis The refresh script accepts the Cursor session token as positional argument `$1`. When entered interactively, the invocation can be retained in shell history. Depending on operating-system process visibility and timing, command-line arguments may also be observable by other local processes or users while the script is running. The token is then supplied as a Docker environment variable. Docker users or administrators able to inspect the container configuration can retrieve environment values. The documentation additionally recommends storing the credential directly in s ...[truncated 1503 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/configuration.md:30
Finding: Proxy Port Is Broadly Published and Remote Credentials Are Sent Over Cleartext HTTP
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (20)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The remote-server example directs users to send token-bearing API traffic to an http:// endpoint on a server IP, which exposes authentication credentials and prompt/response contents to interception or modification by anyone on the network path. In a remote deployment context this is especially dangerous because the configuration normalizes unauthenticated transport for a reusable session token without any warning or compensating control.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The command pulls and runs a container image using a mutable tag (latest) rather than a pinned version or digest. This makes deployments non-reproducible and creates a supply-chain risk: if the upstream image is changed, compromised, or replaced, users may silently run unreviewed code with access to the supplied session token and exposed local service port.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This installation example also uses a mutable container reference (latest), which can cause users to execute different code over time without noticing. In this skill's context, that is more dangerous because the container is given a sensitive WORKOS_CURSOR_SESSION_TOKEN, so a malicious image update could exfiltrate credentials or proxy user traffic.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation explicitly instructs users to place long-lived session/API tokens in shell startup files and an environment file, which commonly persist on disk in plaintext and may be exposed through backups, shell history, support bundles, local compromise, or accidental sharing of dotfiles. Because the token appears to be a WorkOS/Cursor session credential, exposure could let an attacker impersonate the user against the proxied API until the token is revoked or expires.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions require a WorkosCursorSessionToken and show it being passed directly via environment variable and example commands, but they do not warn users that this is a sensitive credential or explain secure handling. This increases the chance of token leakage through shell history, copied compose files, screenshots, logs, or insecure storage.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The documentation instructs users to deploy waitkafuka/cursor-api:latest, which uses a mutable tag instead of a pinned version or digest. This creates supply-chain risk because future image changes could silently introduce vulnerable or malicious code, and users would deploy it without noticing.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/installation.md (reported line 59)May include surrounding context.
OpenAI format:

bash
curl -X POST http://localhost:3010/v1/chat/completions \ -H "Content-Type: application/json" \ -H "Authorization: Bearer your_token" \ -d '{

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document instructs users to place sensitive tokens directly into shell commands and persistent shell startup files without warning about shell history, process listing, local file exposure, or accidental copy/paste leakage. In this context, the skill is explicitly about handling a session token and repurposing it as an API credential, which increases the likelihood of credential compromise and downstream account misuse.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 96% confidence
Finding: The guidance tells users to persist ANTHROPIC_API_KEY="YOUR_TOKEN" in ~/.zshrc, causing a sensitive credential to be stored long-term in plaintext in a widely read initialization file. In this skill's context, the value is not a scoped API key but a session-derived token, making persistent storage more dangerous because compromise could expose broader account access.
Content: Scanner excerpt · references/quick-reference.md (reported line 16)May include surrounding context.
Environment Setup

bash
# Add to ~/.zshrc export ANTHROPIC_BASE_URL="http://localhost:3010/v1" export ANTHROPIC_API_KEY="YOUR_TOKEN" export ANTHROPIC_DEFAULT_SONNET_MODEL="claude-sonnet-4-6"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The command sends a live session token in an HTTP Cookie header to an external service endpoint. Although the transmission is over HTTPS and may be operationally intended, it still exposes a high-value credential to manual handling and network use outside a safer authenticated client flow; if copied, logged, or misdirected, the token could enable unauthorized access to the associated account.
Content: Scanner excerpt · references/quick-reference.md (reported line 28)May include surrounding context.
bash
# Check validity curl -s -o /dev/null -w "%{http_code}" \ -H "Cookie: WorkosCursorSessionToken=YOUR_TOKEN" \ https://api2.cursor.com/v1/me

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill gives step-by-step instructions for extracting a live browser session cookie and reusing it in API requests and a third-party container. In this context, the token effectively grants account access, so operationalizing its extraction and reuse substantially increases the risk of credential theft, unauthorized account use, and privacy loss.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/token.md (reported line 37)May include surrounding context.
Method 2: CLI Verification

bash
curl -s -o /dev/null -w "%{http_code}" \ -H "Cookie: WorkosCursorSessionToken=your_token" \ https://api2.cursor.com/v1/me

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document warns not to store tokens in plaintext, yet the provided workflow passes the session token as a shell argument and into a Docker environment variable. This exposes the credential to shell history, process listings, logs, container inspection output, and potentially other local users or monitoring systems, making account compromise more likely.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The script pulls and runs waitkafuka/cursor-api:latest, which is a mutable tag and can change over time without review. Because this script injects a sensitive session token into the container environment, a compromised or unexpectedly updated image could exfiltrate the token or alter service behavior, making the risk more serious in this context than a generic reproducibility issue.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file is named refresh-token.sh, but the header comment identifies it as cursor-token-refresh.sh. This documentation does not match the artifact being shipped and can mislead reviewers about the script's identity and intended invocation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Missing User Warnings

Rp1

Rp1

Missing User Warnings

Missing User Warnings

Rp1

Rp1

External Transmission

Rp1

Rp1

Rp1

Rp1

Missing User Warnings

Session Persistence

Environment Setup

External Transmission

Missing User Warnings

External Transmission

Method 2: CLI Verification

Intent-Code Divergence

Rp1

Intent-Code Divergence

Static analysis