ClawHub
Back to skill

Security audit

Cursor

Security checks for vulnerabilities and agentic risk

Overview

The skill is a read-only Cursor/OOMOL connector, but its activation wording is too broad for access to team spend, audit logs, usage, and member data.

Install only if you want agents to query your connected Cursor team data through OOMOL. Use it for explicit requests about usage, spend, audit logs, or team members; avoid letting it handle general Cursor help or product questions that do not need private account access.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill description says to use this skill for ANY Cursor request and whenever a task involves Cursor, which is broad enough to trigger the skill for a wide range of loosely related requests. That can cause unintended activation and over-permissive routing, increasing the chance that sensitive team/account data is queried when a narrower, more context-specific tool selection would have been more appropriate.

Static analysis

No suspicious patterns detected.