Cursor CLI

• Analyzed: May 12, 2026, 4:10 AM
• Findings: 1
• Version: 1.1.1
• Hash: 8cf142e886f0e17b6bc387255e27356cca1abd0fc78ae2e58198e7ac3cba6656
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill defines commands in SKILL.md that execute external binaries (`cursor`, `cursor-agent`) with user-provided arguments. While the stated purpose is benign (interacting with the Cursor editor and AI agent), the direct interpolation of user input into shell commands (e.g., `file.py:line`, `your question`) creates a significant shell injection vulnerability (RCE risk) if the OpenClaw agent does not perform robust input sanitization. This is a risky capability without clear malicious intent, thus classified as suspicious.