ClawHub
Back to skill

Security audit

Cursor Council

Security checks for vulnerabilities and agentic risk

Overview

This skill has a legitimate multi-agent workflow, but it encourages force-running and blindly approving delegated agents while saving and sharing sensitive prompts without enough guardrails.

Review this skill before installing. Use it only in disposable branches, worktrees, or sandboxes; remove --force by default; do not approve agent prompts without reading them; redact secrets and internal details before sending prompts to external models; and store or delete council logs according to your project's data-handling rules.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
references/council-deliberation.md:69
Finding

Unattended Agent Execution and Blind Approval Bypass Human Authorization Controls

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: cursor-council
description: Multi-Cursor orchestration for parallel task execution and AI council deliberation. Use when needing to run multiple Cursor agents in parallel, coordinate complex multi-step coding tasks, get diverse perspectives from different AI models (Opus/Sonnet/GPT) on technical decisions, or synthesize multi-agent discussions into actionable recommendations.
metadata:
  {
    "openclaw":
      {
        "emoji": "🎭",
        "author": "xiaoyaner",
        "version": "2.0.0",
        "requires": { 
          "bins": ["tmux", "agent"],
          "skills": ["cursor-agent"]
        },

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The workflow tells users to paste a framed question into prompts sent to multiple external models, including third-party providers, without any warning about confidentiality, data classification, or provider trust boundaries. In practice, users may include proprietary architecture, incident details, unreleased product plans, or security-relevant context, causing unintended disclosure to external services.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
95% confidence
Finding

This step directs the user to invoke an external model provider for deliberation, which creates a clear outbound data flow to a third party. In a skill centered on architecture and risk decisions, the pasted prompt is especially likely to contain sensitive technical details, making provider selection and disclosure boundaries security-relevant.

Content

Scanner excerpt · references/council-deliberation.md (reported line 82)May include surrounding context.

md
done

# Opus query
tmux send-keys -t council-opus "agent --model claude-opus-4 -p '
You are a senior architect. Analyze this decision:

[Paste framed question]

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
95% confidence
Finding

This command uses another external model endpoint and similarly encourages sending decision context outside the organization. Because the surrounding skill is designed for multi-model consultation, repeated sharing across providers compounds exposure and broadens the set of parties that may receive internal information.

Content

Scanner excerpt · references/council-deliberation.md (reported line 95)May include surrounding context.

md
' --force" Enter

# Sonnet query  
tmux send-keys -t council-sonnet "agent --model claude-sonnet-4 -p '
You are a pragmatic engineer. Evaluate this decision:

[Paste framed question]

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
96% confidence
Finding

This command sends the framed question to an external GPT model, again without guardrails around what can be shared. The 'challenger' role encourages broad context and alternative industry comparisons, which can prompt users to disclose more internal detail than necessary and increases risk of proprietary or security-sensitive leakage.

Content

Scanner excerpt · references/council-deliberation.md (reported line 108)May include surrounding context.

md
' --force" Enter

# GPT query
tmux send-keys -t council-gpt "agent --model gpt-5 -p '
Challenge conventional thinking on this decision:

[Paste framed question]

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructions, headings, and operational guidance are predominantly in Chinese, which effectively forces a specific language for users of the skill. The file does not provide an opt-in, alternative language option, or justification that the skill is intended only for a Chinese-language audience.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly instructs users to persist full prompts and model outputs to disk, and those artifacts can easily contain proprietary code, credentials, architecture details, incident data, or other sensitive project context. In this skill's context, multiple agent sessions are encouraged and outputs are centrally archived, which increases the volume of retained sensitive material and the blast radius if the archive is later exposed or shared.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide explicitly instructs users to capture all model outputs and append them to a local file, but it provides no warning that those outputs may contain sensitive source code, architecture details, credentials accidentally echoed by tools, or internal risk discussions. Persisting this material increases exposure by creating a durable artifact that may be indexed, committed, shared, or left on disk beyond the original session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file instructs users to run tmux kill-session as part of a clean start, which forcefully terminates existing sessions. The surrounding documentation does not warn that this can interrupt active agent tasks or discard unsaved terminal context, so the destructive behavior is not disclosed to the user.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file contains prescriptive natural-language guidance in Chinese, which effectively imposes a specific language/locale on skill usage. The policy for SQP-3 flags language or locale constraints when the skill does not explicitly offer the user a choice or explain a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file presents the README template in Chinese (for example, 'Council 会议记录的 README 模板') and continues with Chinese headings and placeholders throughout, but does not indicate that the user may choose another language or that the template is intended only for a Chinese-language workflow. This creates a natural-language locale policy concern because the template implicitly mandates a specific language without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The command tmux capture-pane ... > cursor-1-log.txt persists terminal output to a file, which may include prompts, code, stack traces, or other sensitive project data. The markdown does not disclose that this creates a disk artifact or advise users to handle or clean up the log file appropriately.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.