Security audit

OpenClaw Cursor Agent

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says, but it gives OpenClaw broad control over trusted background Cursor sessions and needs careful review before use.

Install only if you intentionally want OpenClaw to start and control trusted Cursor coding sessions on your machine. Keep it bound to localhost or a private authenticated network, do not expose it publicly without strong auth and firewall rules, treat task logs as sensitive, use trusted project paths and task inputs, back up important work, and review diffs before accepting changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises capabilities to launch and manage persistent Cursor/tmux jobs, which inherently implies shell execution, environment access, and likely file read/write, but it declares no permissions or trust boundaries in the skill metadata. This creates an authorization and transparency gap: users and the host system are not explicitly warned that the skill can start background processes and affect local state.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The design explicitly enables tmux pane output logging while running a long-lived coding agent, but the reference does not require any user-facing notice, consent, or data-handling guardrails. Because terminal output can contain source code, secrets, tokens, prompts, or sensitive file contents, silent recording increases the risk of unintended retention and later disclosure.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README explicitly documents starting persistent background coding jobs and killing running sessions, but it does not warn users that these actions can execute code for long periods, modify project files, consume system resources, or terminate active work. In the context of an agent skill that brokers commands into WSL, tmux, and Cursor CLI, missing safety guidance increases the chance of accidental destructive or unauthorized system-affecting actions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The workflow explicitly instructs the agent to start, monitor, send commands to, and kill persistent background tmux/Cursor sessions, but it does not include any user-facing warning or confirmation step for these system-impacting actions. Background process creation and command injection into long-running sessions can consume resources, alter files, and execute unintended operations without sufficiently informed consent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The runner invokes the Cursor/agent CLI with `--trust --force` and feeds it prompt content that can come from user-controlled task descriptions or an external task file. In this skill’s context, that means unreviewed instructions are executed in a persistent coding session with elevated trust, increasing the chance of unsafe file access, command execution, or malicious prompt-driven actions across the workspace.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide instructs users to run a restore script that copies multiple directories and config files into ~/.openclaw, but it does not warn that existing local configuration, sessions, workspace data, and automation state may be overwritten or merged unexpectedly. In this skill’s context, those files can affect agent behavior, stored credentials, and task history, so silent restoration creates meaningful integrity and operational risk.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The networking section tells users to bind the service to 0.0.0.0 and expose it via Tailscale, public IP, or FRP, but does not clearly emphasize the increased attack surface or require validation of authentication, origin restrictions, and firewall controls. Because this skill manages long-running agent tasks and sessions, remote exposure could allow unauthorized control or data access if the surrounding security settings are weak or misconfigured.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The document instructs users to pipe a remotely fetched script directly into bash, which executes unreviewed code from the network with the user's privileges. If the remote server, transport, or script content is compromised, this can lead to arbitrary code execution inside the WSL environment and potentially access local files, credentials, git config, and linked developer resources.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document instructs creating a GitHub repository, modifying README, and pushing code without an explicit warning that this causes remote publication and local file changes. In an agent-driven workflow, that raises the risk of accidental data disclosure, publication of sensitive code, or unreviewed modifications being pushed to a public or organizational repository.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The guide encourages users to delegate natural-language coding tasks to a background Cursor agent that can modify project files, but it does not clearly warn that filesystem changes may occur asynchronously and outside the user's immediate review. In this skill context, that omission is meaningful because the whole purpose of the tool is persistent background task execution, increasing the chance of unintended edits, scope creep, or unnoticed destructive changes.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The guide documents pause/resume/stop controls for long-running background sessions but does not warn that terminating or interrupting a task may leave partial edits, inconsistent state, or loss of agent context. In a tmux-backed coding workflow, abrupt session control can easily strand in-progress file operations or confuse users about whether work was safely saved.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The skill description and trigger examples are broad enough that the agent may invoke this skill whenever a user merely mentions terms like tmux, /cursor, spawn, or status, even if the user did not intend to start or control a persistent background coding session. In this context, unintended activation is meaningful because the skill can create, inspect, send commands to, or kill long-running tmux-backed Cursor sessions, increasing the chance of acting on the wrong task or exposing state from an unrelated session.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: extensions/openclaw-cursor-agent/index.js:175