Security audit

ClawdCursor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed desktop automation tool, but it asks users to install and run mutable remote code with broad desktop, screenshot, and credential-adjacent access.

Install only if you are comfortable granting a local desktop automation service access to your screen and apps. Prefer running it in a constrained user account or VM, verify the upstream repository and package versions yourself, use Ollama/local mode when possible, and avoid letting it access email, banking, password managers, admin consoles, or private messages without task-specific confirmation.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:24
Finding: Mutable Remote Repository Is Retrieved and Executed Without Commit Pinning
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:356
Finding: Unpinned npm Installation and npx Execution Expose the Setup Process to Supply-Chain Compromise
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The instruction to use the desktop agent 'when the user asks you to interact with their desktop, or when no other tool can accomplish the task' is ambiguous and can justify autonomous escalation to GUI automation without a clear user opt-in for that specific action. Because this skill can see the screen and manipulate arbitrary apps, ambiguity in invocation criteria materially increases the risk of privacy and integrity violations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill frames GUI control as broadly applicable to 'any action visible and interactable in the GUI,' which effectively grants an agent extremely wide operational scope over the user's desktop. In the context of a desktop automation skill with screenshot access, broad activation language increases the chance of overreach into sensitive applications, unintended destructive actions, or privacy-invasive behavior when safer direct tools exist.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 97% confidence
Finding: The guidance to 'start it yourself (don't ask the user)' encourages autonomous process execution on the user's machine. In a skill that can control the desktop and inherit provider credentials, silently launching background services reduces user awareness and weakens consent boundaries, which can be abused to initiate monitoring or automation capabilities without an explicit approval moment.
Content: Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.
Expected: {"status":"ok","version":"0.6.0"}

If connection refused — start it yourself (don't ask the user):

powershell
# Find the skill directory and start the server Start-Process -FilePath "node" -ArgumentList "dist/index.js","start" -WorkingDirectory "<clawd-cursor-directory>" -WindowStyle Hidden

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill instructs users/agents to run npx clawd-cursor without pinning a specific version, which makes execution depend on whatever package version is current at install time. That creates a supply-chain risk: a malicious or compromised newer release could be pulled and executed automatically with the user's local privileges.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: Using npx ts-node without a pinned version allows the resolved package version to vary over time and may fetch code from the package registry at execution time. In a developer utility context this is common, but it still exposes users to avoidable supply-chain compromise if the package or its transitive dependencies are tampered with.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.