ClawHub
Back to skill

Security audit

OpenClaw Cursor Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill's main purpose is coherent, but it exposes powerful Cursor/tmux control without enough authorization or scoping and includes unsafe setup instructions.

Review before installing. Use only in a trusted, isolated OpenClaw environment; remove the personal backup restore instructions, avoid curl-to-shell installers, require authentication for /cursor, restrict allowed project roots, remove default --trust/--force behavior, and fix shell escaping before using it with valuable repositories or credentials.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
docs/LOCAL_SETUP_GUIDE.md:43
Finding

Setup documentation executes mutable remote installation scripts

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
docs/LOCAL_SETUP_GUIDE.md:112
Finding

Unrelated personal backup restores executable extensions, agent state, and scheduled-task configuration

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
cursor-agent-system/scripts/spawn-cursor.sh:255
Finding

User-controlled values are interpolated into an executable runner script without shell escaping

Content
View full analysis
"${RUNNER_FILE}" <
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
extensions/openclaw-cursor-agent/index.js:610
Finding

Unauthenticated command interface can control trusted Cursor coding sessions

Content
View full analysis
item !== "--force")[0]; const result = await handleKillTool(config, { sessionQuery, force, purge: false, }); return { text: result.content[0].text }; } if (subcommand === "spawn") { const parts = tail.split("||").map((item) => item.trim()).filter(Boolean); if (parts.length < 2) { return { text: "spawn 用法: /cursor spawn <任务名> || <任务描述> || [项目路径]" }; } const [taskName, taskDescription, projectPath] = parts; const result = await handleSpawnTool(config, { taskName, taskDescription, projectPath }); return { text: result.content[0].text }; } }, }); } ``` Spawned sessions invoke Cursor with elevated trust settings: ```bash PROMPT_CONTENT="$(cat "${PROMPT_FILE}")" '${AGENT_BIN}' --trust --force --print \ --output-format stream-json \ --stream-partial-output \ --workspace "${OPENCLAW_WORKSPACE_P ...[truncated 2241 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (64)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
- [插件入口](extensions/openclaw-cursor-agent/index.js) — 工具注册和执行逻辑

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · docs/LOCAL_SETUP_GUIDE.md (reported line 62)May include surrounding context.

bash
# 更新系统
sudo apt update && sudo apt upgrade -y

# 安装 Node.js 22
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

Piping curl output directly into sudo -E bash is a classic dangerous chaining pattern because it combines download, interpretation, and privileged execution into one opaque step. In this skill's context, that is especially risky because the host is being prepared to run persistent agent services and store sensitive sessions and configuration.

Content

Scanner excerpt · docs/LOCAL_SETUP_GUIDE.md (reported line 65)May include surrounding context.

md
sudo apt update && sudo apt upgrade -y

# 安装 Node.js 22
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt install -y nodejs

# 安装 ffmpeg

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The WSL instructions repeat the same unsafe chain of downloading content and immediately executing it as root. This makes compromise easy if the remote content, transport, or environment is manipulated.

Content

Scanner excerpt · docs/LOCAL_SETUP_GUIDE.md (reported line 84)May include surrounding context.

md
sudo apt install -y curl

# 安装 Node.js 22
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt install -y nodejs ffmpeg

# 验证

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

curl | sh is an unsafe chain because it executes network-fetched code without inspection or integrity validation. On a machine exposing OpenClaw services and bot webhooks, that could lead to remote control of the host and long-lived persistence through the installed tooling.

Content

Scanner excerpt · docs/LOCAL_SETUP_GUIDE.md (reported line 200)May include surrounding context.

Linux:

bash
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

Piping a remotely fetched script directly into bash executes unreviewed code from the network with the user's privileges, eliminating any inspection or integrity verification step. In this agent ecosystem, where the installed CLI is later used to run persistent background tasks, compromise at install time could grant durable execution capability and downstream access to projects, credentials, and shell sessions.

Content

Scanner excerpt · docs/archive/WSL最终落地方案.md (reported line 79)May include surrounding context.

在 WSL 中执行：

bash
curl https://cursor.com/install -fsS | bash
agent --version

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The | bash construct is dangerous because it chains network retrieval directly into shell execution, making tampering, server compromise, or operator copy/paste mistakes immediately executable. In the context of a tool meant to orchestrate background coding agents through tmux and WSL, this raises the risk of persistent compromise of the execution environment.

Content

Scanner excerpt · docs/archive/WSL最终落地方案.md (reported line 79)May include surrounding context.

在 WSL 中执行：

bash
curl https://cursor.com/install -fsS | bash
agent --version

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · extensions/openclaw-cursor-agent/index.js (reported line 27)May include surrounding context.

js
t: "",
  defaultProjectPath: "",
  executionMode: process.platform === "win32" ? "wsl" : "direct",
  timeoutMs: 120000,
  shell: {
    executable: process.platform === "win32" ? "wsl.exe" : "bash",
    args: [],
    workingDirectory: "",
    wslDistro: "",
  },
};

const SPAWN_SCHEMA = {
  type: "object",
  required: ["taskName", "taskDescription"],
  properties: {
    taskName: { type: "string", description: "Short task label, for example feature-auth" },
    taskDescription: { type: "string", description: "The prompt that Cursor CLI should execute" },
    projectPath: { type: "string", description: "Optional project directory" },
    priority: { type: "string", description: "Task priority, for example low, normal, high" },
    eta: { type: "string", description: "Estimated duration, for example 45分钟" },
    taskFile: { type: "string", description: "Optional existing markdown task file" },
  },
};

const SESSION_SCHEMA = {
  type: "object",
  required: ["sessionQuery"],
  properti

Session Persistence

Medium
Category
Rogue Agent
Confidence
70% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · .cursor/skills/openclaw-cursor-agent-system/SKILL.md (reported line 16)May include surrounding context.

md
cursor-agent-system/
├── scripts/
│   ├── common.sh          # Shared utilities
│   ├── spawn-cursor.sh    # Start background task
│   ├── check-status.sh    # Query task status
│   ├── attach-session.sh  # Attach to tmux session
│   ├── send-command.sh    # Send instructions to task

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The README presents background execution and task termination as normal operations but does not warn users that these actions create persistent processes, consume system resources, and can alter code or kill active work. For an agent skill that bridges chat input to tmux-managed Cursor CLI sessions, the lack of safety warnings and operational constraints increases the risk of accidental or unauthorized system-impacting actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README encourages broad natural-language commands like starting, modifying, and stopping persistent coding jobs without defining confirmation requirements, scope limits, or safety boundaries. In a skill that can launch long-running tmux/Cursor sessions and send follow-up commands, vague triggers increase the chance of unintended execution, misuse, or prompt-driven task manipulation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises and references capabilities that can start persistent tmux-backed coding sessions and interact with the shell, but it declares no explicit tool scope or permission boundaries. In an agent ecosystem, missing scope declarations increases the chance that the skill is invoked with broader-than-necessary access, enabling unintended file, environment, or command execution paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The activation cues are broad and include common phrases about background tasks, status checks, tmux, and generic task control, which can cause over-triggering in ordinary conversation. If auto-selected, the skill could launch or manipulate persistent coding sessions when the user only intended to discuss them, creating unnecessary system-side actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Most user-facing documentation and examples are written in Chinese, and the natural-language mapping assumes Chinese inputs, while the skill does not state that language is optional or provide an opt-in choice. This creates a locale/language constraint that is not documented as region-specific or user-selectable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The workflow explicitly describes starting, controlling, and killing persistent background sessions but provides no user warning or confirmation around system-impacting behavior. Because these actions can consume resources, alter code, or terminate active work, lack of warning raises the risk of accidental destructive or costly operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script's comments, usage text, and operational messages are entirely in Chinese, which imposes a specific language on users without offering any choice or opt-in. Under the stated policy, a skill should not force a language or locale unless it is explicitly justified or user-selectable.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

User-facing comments, help text, status labels, and runtime messages are consistently hard-coded in Chinese throughout the script. There is no indication of user opt-in, locale detection, or documented justification that this skill is intentionally limited to a Chinese-speaking environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The info, warn, and error helpers emit user-facing text only in Chinese (e.g. 信息, 警告, 错误, 缺少命令). This enforces a specific language for operator-visible output without offering a language choice or documenting a justified locale restriction, which matches the policy-violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script's comments, usage text, and user-facing messages are entirely in Chinese, such as the description and installation prompts. This imposes a specific language on all users with no opt-in or alternative locale handling, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script launches the Cursor/agent CLI with both --trust and --force, suppressing normal safety friction while passing a prompt built from user-controlled task content into a long-running coding agent operating on a real workspace. In this skill’s context, that materially increases the chance of unsafe file modification, command execution, or acceptance of dangerous instructions without any explicit user confirmation or warning at launch time.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill template forces all instructions, status output, and control guidance to be in Chinese. This is a natural-language policy concern because the file does not provide user opt-in, alternative language options, or a documented reason for restricting the skill to a specific language/locale.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/LOCAL_SETUP_GUIDE.md (reported line 62)May include surrounding context.

bash
# 更新系统
sudo apt update && sudo apt upgrade -y

# 安装 Node.js 22
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/LOCAL_SETUP_GUIDE.md (reported line 80)May include surrounding context.

bash
# 更新系统
sudo apt update && sudo apt upgrade -y

# 安装 Node.js 22
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/LOCAL_SETUP_GUIDE.md (reported line 81)May include surrounding context.

bash
# 更新系统
sudo apt update && sudo apt upgrade -y

# 安装 Node.js 22
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · docs/LOCAL_SETUP_GUIDE.md (reported line 195)May include surrounding context.

bash
# 更新系统
sudo apt update && sudo apt upgrade -y

# 安装 Node.js 22
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -