Cursor Cloud Agents

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:14 PM UTC
• Version: 1.3.3

Overview

The skill mostly does what it advertises, but it handles Cursor credentials in ways that could expose them if the environment is misconfigured or controlled by someone else.

Review this before installing if you use Cursor on private repositories. Prefer setting CURSOR_API_KEY only in a dedicated file or environment variable, do not set CURSOR_API_BASE unless testing with throwaway credentials, and clear or protect ~/.cache/cursor-api on shared machines.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/cursor-api.sh:47

Finding

Cursor API Key Disclosure Through an Unrestricted API Base Override

Content

View full analysis

"$curl_stderr") || { error "curl failed: $(cat "$curl_stderr")" "$E_API_ERROR" } else if [[ -n "$body" ]]; then response=$(curl "${curl_opts[@]}" "${headers[@]}" -X "$method" -d "$body" "$url" 2>"$curl_stderr") || { error "curl failed: $(cat "$curl_stderr")" "$E_API_ERROR" } else response=$(curl "${curl_opts[@]}" "${headers[@]}" -X "$method" "$url" 2>"$curl_stderr") || { error "curl failed: $(ca ...[truncated 2437 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cursor-api.sh:233

Finding

Sensitive Agent Responses and Prompts Are Cached Without Enforced Access Permissions

Content

View full analysis

"$cache_file" } ``` ```bash # Save background task info save_bg_task() { local task_id="$1" local agent_id="$2" local repo="$3" local prompt="$4" local status="$5" local pid="$6" local max_runtime="${7:-86400}" init_bg_tasks_dir local task_file="${BG_TASKS_DIR}/${task_id}.json" jq -n \ --arg task_id "$task_id" \ --arg agent_id "$agent_id" \ --arg repo "$repo" \ --arg prompt "$prompt" \ --arg status "$status" \ --arg pid "$pid" \ --arg created_at "$(date -Iseconds)" \ --arg max_runtime "$max_runtime" \ '{ task_id: $task_id, agent_id: $agent_id, repo: $repo, prompt: $prompt, status: $status, pid: $pid, created_at: $created_at, max_runtime: $max_runtime }' > "$task_file" } ``` ### Technical Analysis The Skill stores successful GET responses in `~/.cache/cursor-api/` and stores complete background-task prompts and repository metadata under `~/.cache/cursor-api/background-tasks/`. Neither path is created with an explicit restrictive mode. The files are also written without applying mode `0600` or first establishing `umask 077`. Their effective permissions therefore depend on the environment in which the Skill runs. Under a permissive umask, other local users may be able to read the files. Cached API responses may include: - Full agent conversations. - User prompts and generated responses. - Agent and pull-request metadata. - Cursor account identi ...[truncated 1877 chars]

Remediation

View remediation

/conversation` by default. Require explicit opt-in if conversation caching is needed. 6. Minimize persisted background-task data. Store a prompt hash or redacted summary instead of the complete prompt unless retaining the full prompt is essential. 7. Implement an automatic expiration and cleanup policy for completed tasks, logs, and cached conversations. 8. Verify that the cache directory and files are owned by the current user and reject symlinks or unexpected file types before reading or writing. 9. Add tests that run the script under a permissive umask and verify directory mode `0700` and file mode `0600`. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (57)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 103)May include surrounding context.

bash

git clone https://github.com/Parcosta/cursor-cloud-agents.git ~/.openclaw/skills/cursor-cloud-agents

Standalone Usage

After installation, use the skill directly:

bash

cursor-cloud-agents --help

Short Commands (Optional)

For faster daily usage, enable short-form cca aliases by sourcing the aliases file:

bash

# One-time setup: Add to your ~/.bashrc or ~/.zshrc
echo 'source ~/.openclaw/workspace/projects/cursor-cloud-agents/scripts/cca-aliases.sh' >> ~/.bashrc

# Or source manually for current session
source ~/.openclaw/workspace/projects/cursor-cloud-agents/scripts/cca-aliases.sh

Then use short commands:

bash

cca list              # List all agents
cca ls                # Short for 'list'
cca launch --repo owner/repo --prompt "Add tests"
cca status <agent-id>
cca conv <agent-id>   # Short for 'conversation'
cca fu <agent-id> --prompt "..." # Short for 'followup'
cca rm <agent-id>     # Short for 'delete'

All standard commands work with

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 77)May include surrounding context.

1. Store CURSOR_API_KEY in ~/.openclaw/.env with restricted permissions:

   bash

   chmod 600 ~/.openclaw/.env
   

2. Never commit API keys to version control

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 72)May include surrounding context.

1. Store CURSOR_API_KEY in ~/.openclaw/.env with restricted permissions:

   bash

   chmod 600 ~/.openclaw/.env
   

2. Never commit API keys to version control

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cursor-api.sh (reported line 576)May include surrounding context.

sh

1. Store `CURSOR_API_KEY` in `~/.openclaw/.env` with restricted permissions:
   ```bash
   chmod 600 ~/.openclaw/.env
   ```

2. Never commit API keys to version control

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents this skill as a deployment automation tool for Cursor AI agents operating on GitHub repositories to write code and open PRs. However, the supplied code chunk is only a shell convenience script that, when sourced, defines a cca wrapper around another script (cursor-api.sh). Its primary behavior is local CLI aliasing and command forwarding, plus help/version output and a path sanity check. While some forwarded commands like launch may be related to agent deployment, this chunk itself does not implement the described repo automation behavior. It also exposes additional account and background-task management capabilities not mentioned in the description. Therefore the description does not accurately represent what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code is related to the declared domain of managing Cursor agents for GitHub repos, and it does support launching agents that could write code and create PRs. However, the description is narrower than the implementation. The script is not specifically a 'deploy agents to GitHub repos' tool only; it is a broader Cursor API management wrapper with lifecycle management, conversation retrieval, follow-up messaging, model listing, account inspection, usage reporting, repo verification, deletion, caching, and local background monitoring/logging. These are materially undeclared capabilities, especially account/usage access and local credential/config discovery. No unrelated trigger behavior is present, but the declared description does not accurately capture the broader management and data-access behavior of the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description describes an automation skill for deploying Cursor AI agents to GitHub repositories and performing repository actions like code writing, test generation, documentation generation, and PR creation. The actual code chunk is instead a local test harness for validating another shell script. Its primary purpose is QA/test execution, not GitHub repo automation or agent deployment. This is a material purpose mismatch. While the code references a Cursor API key for integration tests, it still does not implement the declared repo/PR functionality in this chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear mismatch between the declared purpose and the observed code. The description promises automation around deploying Cursor AI agents to GitHub repos and performing development tasks like code writing, test generation, documentation generation, and opening PRs. The supplied code does none of that. Instead, it acts as a validation utility for a skill/repository structure, likely to ensure publishability to a hub ('clawdhub'). It performs only local filesystem inspection and lint-like checks, with no GitHub access, no Cursor subscription usage, no agent deployment, and no code/test/doc/PR generation. This is a materially different primary purpose, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill is designed to read credentials from local env/config files, including project-level .env files that often contain many unrelated secrets beyond the Cursor API key. Granting broad read access to such files increases the blast radius of compromise and can expose secrets unnecessarily to the skill runtime or any dependent tooling.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

- base64
  files:
    read:
      - ~/.openclaw/.env
      - ~/.openclaw/.env.local
      - .env
      - ~/.cursor/config.json

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Reading ~/.openclaw/.env.local similarly grants access to potentially sensitive local secrets unrelated to this skill. Because the file may contain per-user overrides and tokens, this behavior materially expands credential exposure beyond what is required for operation.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

files:
    read:
      - ~/.openclaw/.env
      - ~/.openclaw/.env.local
      - .env
      - ~/.cursor/config.json
    write:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

Reading ~/.cursor/config.json can expose broader application configuration and tokens, and combined with project/global .env access creates multiple credential-harvesting surfaces. Even if intended for convenience, this is dangerous because it normalizes access to sensitive local files without strict minimization.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

read:
      - ~/.openclaw/.env
      - ~/.openclaw/.env.local
      - .env
      - ~/.cursor/config.json
    write:
      - ~/.cache/cursor-api/

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

Then use `cca` instead of `cursor-api.sh`:

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

md

cursor-api.sh launch --repo owner/repo --prompt "Add comprehensive tests for auth module"

# Launch with specific model
cursor-api.sh launch --repo owner/repo --prompt "Add tests" --model claude-4-opus

# Response: {"id": "agent_123", "status": "CREATING", ...}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 202)May include surrounding context.

Permanently deletes an agent and its conversation history.

http

DELETE /agents/:id

Response:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cursor-api.sh (reported line 85)May include surrounding context.

sh

echo "$str"
}

# Get API key from various sources
get_api_key() {
    local key

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Reading credentials from ~/.openclaw/.env is credential access behavior beyond explicit user input and can silently consume secrets stored for other workflows. In a skill context, that increases the chance of unauthorized secret use and accidental exposure through subsequent API requests.

Content

Scanner excerpt · scripts/cursor-api.sh (reported line 96)May include surrounding context.

sh

return 0
    fi

    # Check ~/.openclaw/.env
    if [[ -f "$HOME/.openclaw/.env" ]]; then
        key=$(grep -E '^CURSOR_API_KEY=' "$HOME/.openclaw/.env" | cut -d= -f2-)
        key=$(strip_quotes "$key")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cursor-api.sh (reported line 97)May include surrounding context.

sh

fi

    # Check ~/.openclaw/.env
    if [[ -f "$HOME/.openclaw/.env" ]]; then
        key=$(grep -E '^CURSOR_API_KEY=' "$HOME/.openclaw/.env" | cut -d= -f2-)
        key=$(strip_quotes "$key")
        if [[ -n "$key" ]]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cursor-api.sh (reported line 98)May include surrounding context.

sh

fi

    # Check ~/.openclaw/.env
    if [[ -f "$HOME/.openclaw/.env" ]]; then
        key=$(grep -E '^CURSOR_API_KEY=' "$HOME/.openclaw/.env" | cut -d= -f2-)
        key=$(strip_quotes "$key")
        if [[ -n "$key" ]]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cursor-api.sh (reported line 101)May include surrounding context.

sh

fi

    # Check ~/.openclaw/.env
    if [[ -f "$HOME/.openclaw/.env" ]]; then
        key=$(grep -E '^CURSOR_API_KEY=' "$HOME/.openclaw/.env" | cut -d= -f2-)
        key=$(strip_quotes "$key")
        if [[ -n "$key" ]]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cursor-api.sh (reported line 119)May include surrounding context.

sh

fi

    # Check ~/.openclaw/.env
    if [[ -f "$HOME/.openclaw/.env" ]]; then
        key=$(grep -E '^CURSOR_API_KEY=' "$HOME/.openclaw/.env" | cut -d= -f2-)
        key=$(strip_quotes "$key")
        if [[ -n "$key" ]]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cursor-api.sh (reported line 120)May include surrounding context.

sh

fi

    # Check ~/.openclaw/.env
    if [[ -f "$HOME/.openclaw/.env" ]]; then
        key=$(grep -E '^CURSOR_API_KEY=' "$HOME/.openclaw/.env" | cut -d= -f2-)
        key=$(strip_quotes "$key")
        if [[ -n "$key" ]]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cursor-api.sh (reported line 123)May include surrounding context.

sh

fi

    # Check ~/.openclaw/.env
    if [[ -f "$HOME/.openclaw/.env" ]]; then
        key=$(grep -E '^CURSOR_API_KEY=' "$HOME/.openclaw/.env" | cut -d= -f2-)
        key=$(strip_quotes "$key")
        if [[ -n "$key" ]]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The script also reads credentials from ~/.openclaw/.env.local, broadening the set of local secret stores it will consume without explicit user confirmation. This materially increases credential exposure risk because local override files often contain sensitive development secrets not intended for this skill.

Content

Scanner excerpt · scripts/cursor-api.sh (reported line 107)May include surrounding context.

sh

fi
    fi

    # Check ~/.openclaw/.env.local
    if [[ -f "$HOME/.openclaw/.env.local" ]]; then
        key=$(grep -E '^CURSOR_API_KEY=' "$HOME/.openclaw/.env.local" | cut -d= -f2-)
        key=$(strip_quotes "$key")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cursor-api.sh (reported line 108)May include surrounding context.

sh

fi

    # Check ~/.openclaw/.env.local
    if [[ -f "$HOME/.openclaw/.env.local" ]]; then
        key=$(grep -E '^CURSOR_API_KEY=' "$HOME/.openclaw/.env.local" | cut -d= -f2-)
        key=$(strip_quotes "$key")
        if [[ -n "$key" ]]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cursor-api.sh (reported line 109)May include surrounding context.

sh

fi

    # Check ~/.openclaw/.env.local
    if [[ -f "$HOME/.openclaw/.env.local" ]]; then
        key=$(grep -E '^CURSOR_API_KEY=' "$HOME/.openclaw/.env.local" | cut -d= -f2-)
        key=$(strip_quotes "$key")
        if [[ -n "$key" ]]; then

Static analysis

No suspicious patterns detected.