ClawdCursor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:11 AM UTC
• Version: 0.7.5

Overview

The skill is a disclosed desktop automation tool, but it asks for broad local control through an unpinned global executable and encourages automatic consent/startup behavior that users should review carefully.

Review this carefully before installing. It is meant to control your desktop, read screen content, use the clipboard, and interact with browser tabs and apps. Prefer a pinned package version, avoid automatic consent/startup until you understand the permissions, and use the confirm gates for sends, deletes, purchases, or other irreversible actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Globally Installed Executable Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 18
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

yaml

- npm install -g clawdcursor

Technical Analysis

The installation instruction retrieves the latest available version of the clawdcursor npm package and installs its executable globally. It does not specify a version or integrity hash. The project contains only SKILL.md; it provides no package lockfile, vendored implementation, or source code with which to verify the installed executable's behavior.

This creates a time-of-review/time-of-installation supply-chain risk. The package installed by a user may differ from the version described and audited in the Skill documentation. A compromised maintainer account, npm package, or later malicious release could therefore introduce arbitrary code without requiring any change to this repository.

Although the metadata identifies Skill version 0.7.5, the installation command does not constrain npm to the corresponding package version. The documentation subsequently directs users to grant desktop-control consent and run the installed executable, increasing the security significance of the unpinned dependency.

Attack Path

1. An attacker compromises the npm package, its maintainer account, or a future release process.
2. The attacker publishes a malicious version under the existing clawdcursor package name.
3. A user follows the documented npm install -g clawdcursor instruction.
4. npm resolves and globally installs the attacker-controlled current release.
5. The user runs clawdcursor consent --accept and starts clawdcursor serve, clawdcursor mcp, or clawdcursor start.
6. The malicious executable runs with the user's privileges and can misuse the desktop-automation access granted to it.

Impact Assessment

Successful exploitation could provide arbitrary code execution ...[truncated 641 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to the reviewed release, such as:

   bash

   npm install -g clawdcursor@0.7.5
   

2. Publish and verify a cryptographic integrity hash or signed release artifact before installation.

3. Include auditable source code, a package manifest, and a lockfile in the reviewed project so the executable dependency graph can be assessed.

4. Prefer a project-local installation over a global installation where practical, and invoke the pinned binary from that isolated environment.

5. Use npm provenance, package signatures, and a trusted registry policy to reduce maintainer-account and registry compromise risks.

6. Require explicit review of requested desktop-control permissions rather than encouraging automatic consent.

7. Ensure the documented Skill version and installed package version are kept synchronized through automated release checks.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The instruction to start the server automatically without asking the user encourages the agent to initiate a powerful desktop automation service on its own. Because this tool can control applications and access screen content, auto-starting it expands the agent's operational authority and could enable unintended local actions without explicit user awareness at the time of activation.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

POST /execute/type_text {"text": "hello world"}

text

If the server isn't running, start it yourself — don't ask the user:
```bash
clawdcursor serve
# wait 2 seconds, then verify: GET /health

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md

5. **Negative check** — look for error dialogs, wrong window, unchanged screen.

**Always verify** after: sends, saves, deletes, form submissions.
**Skip verification** for: mid-sequence keystrokes, scrolling.

---

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

md

3. cdp_page_context()        → list interactive elements on page
4. cdp_read_text()           → extract DOM text (returns empty on canvas apps → use OCR)
5. cdp_click(text="…")       → click by visible text
6. cdp_type(label, text)     → fill input by label
7. cdp_evaluate(script)      → run JavaScript in page context
8. cdp_scroll(direction, px) → scroll page via DOM (not mouse wheel)
9. cdp_list_tabs()           → list all open tabs

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 435)May include surrounding context.

md

| Linux (x64/ARM64) | AT-SPI | Tesseract | Chrome/Edge |

**macOS:** Grant Accessibility in System Settings → Privacy → Accessibility.
**Linux:** `sudo apt install tesseract-ocr` for OCR support.

Static analysis

No suspicious patterns detected.