ClawdCursor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:11 PM UTC
• Version: 0.6.3

Overview

This skill is a disclosed desktop automation tool, but it asks users to install and run mutable remote code with broad desktop, screenshot, and credential-adjacent access.

Install only if you are comfortable granting a local desktop automation service access to your screen and apps. Prefer running it in a constrained user account or VM, verify the upstream repository and package versions yourself, use Ollama/local mode when possible, and avoid letting it access email, banking, password managers, admin consoles, or private messages without task-specific confirmation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:24
• Finding: Mutable Remote Repository Is Retrieved and Executed Without Commit Pinning<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:24-25` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```yaml - git clone https://github.com/AmrDab/clawd-cursor.git - cd clawd-cursor && npm install && npm run setup ``` ### Technical Analysis The installation procedure clones the current default branch of an external Git repository and immediately installs its dependencies and executes its setup script. No reviewed commit hash, signed release, version tag, or integrity digest is specified. Consequently, the effective code executed by this Skill can change after the Skill itself has been audited. The external repository's setup script and npm lifecycle scripts execute with the permissions of the user or agent performing installation. The implementation retrieved from that repository is not included in the audited project, which contains only `SKILL.md`; its runtime behavior therefore cannot be verified from this artifact. This risk is particularly significant because the declared implementation can inspect screenshots, automate desktop applications, and discover locally configured AI-provider credentials. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or the repository's default branch. 2. The attacker modifies the application, setup script, package manifest, or dependency configuration. 3. A user or agent follows the Skill's installation instructions and clones the mutable default branch. 4. `npm install` runs dependency lifecycle scripts, after which `npm run setup` executes repository-controlled code. 5. The malicious code runs with the invoking user's permissions. 6. It can access files and environment data available to that user, misuse desktop-automation capabilities, or transmit sensitive information over the network. ### Impact Assessment Successful exploitation permits arbitrary code execution under the invoking user's account. T ...[truncated 501 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the Git repository to a specific, reviewed commit hash rather than cloning and executing the mutable default branch. 2. Distribute the implementation through signed, immutable releases with published checksums. 3. Verify the expected commit, release signature, and artifact digest before executing any setup command. 4. Include the executable source in the Skill package where possible so it can be audited together with `SKILL.md`. 5. Require explicit user approval before downloading or executing remote code. 6. Run setup in a restricted environment with minimal filesystem, credential, GUI, and network access. 7. Document the exact remote endpoints and data categories used by the installed implementation. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:356
• Finding: Unpinned npm Installation and npx Execution Expose the Setup Process to Supply-Chain Compromise<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:356-359` **Vulnerability Type**: Insecure dependency installation and execution **Risk Level**: High ### Vulnerable Code ```bash git clone https://github.com/AmrDab/clawd-cursor.git cd clawd-cursor npm install && npm run build npx clawd-cursor doctor # auto-detects and configures everything ``` ### Technical Analysis The setup instructions use `npm install`, which may resolve dependency versions dynamically and execute package lifecycle scripts. They also invoke `npx clawd-cursor doctor` without specifying an exact package version or requiring execution of a verified local binary. Depending on the installed package state and npm behavior, `npx` can retrieve and execute a package from the configured registry. An unpinned package version or compromised transitive dependency can therefore introduce executable code that was not present during review. The `doctor` command is described as automatically detecting and configuring the environment. Such functionality generally requires broad inspection of local configuration and increases the consequences of executing an untrusted package. ### Attack Path 1. An attacker compromises the `clawd-cursor` npm package, one of its transitive dependencies, a package maintainer, or the configured npm registry. 2. A malicious release or lifecycle script is published within a version range accepted by the installation. 3. A user or agent runs `npm install`, causing npm to resolve and install the affected component. 4. A malicious installation lifecycle script can execute immediately during dependency installation. 5. The subsequent unversioned `npx clawd-cursor doctor` command executes package-controlled code. 6. The code can inspect or modify data accessible to the invoking account and can potentially abuse the Skill's desktop and credential-discovery context. ### Impact Assessment Exploitation can result in arbitrary user-level code execution during ins ...[truncated 531 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Commit and review a dependency lockfile, then use `npm ci` rather than dynamically resolving packages with `npm install`. 2. Pin all direct dependencies and the `clawd-cursor` executable to exact versions. 3. Replace the unversioned invocation with a verified local binary or an exact version, such as `npx --no-install`, after validating the installed package. 4. Disable lifecycle scripts during dependency installation where feasible, then explicitly run only reviewed build steps. 5. Verify npm package integrity, provenance attestations, signatures, and expected registry configuration. 6. Use automated dependency auditing and supply-chain monitoring for direct and transitive packages. 7. Execute installation and diagnostic commands in a sandbox with restricted network, filesystem, credential, and desktop access. 8. Require user confirmation before any diagnostic process reads local provider configuration or other sensitive files. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The instruction to use the desktop agent 'when the user asks you to interact with their desktop, or when no other tool can accomplish the task' is ambiguous and can justify autonomous escalation to GUI automation without a clear user opt-in for that specific action. Because this skill can see the screen and manipulate arbitrary apps, ambiguity in invocation criteria materially increases the risk of privacy and integrity violations.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill frames GUI control as broadly applicable to 'any action visible and interactable in the GUI,' which effectively grants an agent extremely wide operational scope over the user's desktop. In the context of a desktop automation skill with screenshot access, broad activation language increases the chance of overreach into sensitive applications, unintended destructive actions, or privacy-invasive behavior when safer direct tools exist.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Expected: `{"status":"ok","version":"0.6.0"}`

If connection refused — **start it yourself** (don't ask the user):
```powershell
# Find the skill directory and start the server
Start-Process -FilePath "node" -ArgumentList "dist/index.js","start" -WorkingDirectory "<clawd-cursor-directory>" -WindowStyle Hidden

• Confidence: 97% confidence
• Finding: The guidance to 'start it yourself (don't ask the user)' encourages autonomous process execution on the user's machine. In a skill that can control the desktop and inherit provider credentials, silently launching background services reduces user awareness and weakens consent boundaries, which can be abused to initiate monitoring or automation capabilities without an explicit approval moment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The skill instructs users/agents to run `npx clawd-cursor` without pinning a specific version, which makes execution depend on whatever package version is current at install time. That creates a supply-chain risk: a malicious or compromised newer release could be pulled and executed automatically with the user's local privileges.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: Using `npx ts-node` without a pinned version allows the resolved package version to vary over time and may fetch code from the package registry at execution time. In a developer utility context this is common, but it still exposes users to avoidable supply-chain compromise if the package or its transitive dependencies are tampered with.

Static analysis

No suspicious patterns detected.