ClawHub
Back to skill

Security audit

Cursor Agent for OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed wrapper for running Cursor Agent on coding tasks, with explicit consent and read-only defaults, but users should understand that approved use can expose or modify repository contents.

Install this only if you are comfortable letting an approved Cursor Agent CLI run inspect your selected repository and, after a second confirmation, modify files. Be especially careful with `--cloud`, because the skill itself warns that repository contents may be sent to cursor.com.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger conditions are broad enough to match many ordinary coding requests, including substantial file-editing tasks and phrases like 'write/fix/refactor/review code.' Overbroad activation criteria increase the likelihood of unintended tool invocation, which can expose repository contents to an external CLI and cause edits in contexts where the user expected an inline response.

Behavior Manipulation

Medium
Category
Prompt Injection
Content
# Cursor Agent

Cursor Agent CLI runs on the user's Cursor subscription — zero API cost. Always prefer it over inline code generation for any non-trivial coding task.

## Prerequisites
Confidence
78% confidence
Finding
The phrase 'Always prefer it over inline code generation' is behavior-shaping language that steers the assistant toward a specific external tool primarily on cost grounds. In skill context, this is risky because it can override safer defaults, leading to unnecessary subprocess use, repository access, or file modification opportunities when a lower-risk inline response would suffice.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The skill repeatedly states a read-only-first workflow and says invocation requires explicit approval, but the model-routing table omits an ask/read-only mode for bug-fix, feature, and refactor tasks. That inconsistency can cause agents or operators to invoke the tool in a way that permits edits immediately, bypassing the intended review step and weakening user-consent guarantees.

Intent-Code Divergence

Low
Confidence
84% confidence
Finding
The instruction to always prefer Cursor Agent for any non-trivial coding task conflicts with the later requirement that the skill must not be invoked autonomously and needs explicit user approval. In practice, this kind of priority language can bias an orchestrator toward invoking the tool by default, increasing the chance of subprocess execution without clear opt-in.

Natural-Language Policy Violations

Low
Confidence
86% confidence
Finding
Mandating preference for Cursor Agent over inline generation encourages automatic escalation from normal assistant behavior to an external tool, despite the later consent safeguards. While not inherently malicious, this creates pressure to use a higher-risk execution path that may read local repositories or modify files.

Static analysis

No suspicious patterns detected.