Is amrdab/clawd-cursor safe?

The install instructions require cloning https://github.com/AmrDab/clawd-cursor.git and running npm install && npm run build. This external repository was not cloned or analyzed during this audit. Any malicious code, compromised npm dependency, or postinstall hook in that repository would execute with full user privileges during installation. SKILL.md's claim of 'no postinstall scripts' cannot be verified without auditing that repo's package-lock.json and all transitive dependencies.

The skill's primary functionality captures full desktop screenshots and transmits them to Anthropic or OpenAI APIs for vision processing. Any sensitive content visible on screen — credentials, PII, private documents, authentication tokens, internal dashboards — is sent externally on every task invocation. While disclosed in the privacy notice, this is a structural data exfiltration channel that cannot be disabled without disabling the skill entirely.

The @nut-tree-fork/nut-js library grants the agent native OS-level input injection and screen capture. This means the agent can type into any application, click any UI element, read any on-screen content, and perform any action a human user could. There is no sandboxing. The safety tier system (Auto/Preview/Confirm) is enforced by the skill's own HTTP API, which can be bypassed by any local process calling POST /confirm.

The skill requires AI_API_KEY stored in a .env file in the project root. The installed binary reads this key at runtime. If the external npm package tree contains a compromised dependency, that dependency can read the .env file and exfiltrate the API key, enabling ongoing unauthorized API calls.

The Express API on 127.0.0.1:3847 is accessible to any process running on the host, not just the authorized agent. A malicious local process (or a second agent skill) could issue POST /confirm to approve destructive actions in the 🔴 Confirm tier, effectively bypassing the safety tier system without user knowledge.

npm run build executes scripts defined in the external repository's package.json. These build scripts can invoke any installed binary or download additional tools. Combined with the unaudited dependency tree from npm install, this represents a second code execution vector beyond postinstall hooks.

During this audit, only SKILL.md and _meta.json were installed from the openclaw/skills monorepo. The AmrDab/clawd-cursor repository was not cloned, npm install was not run, and no node binary was executed. All observed network traffic (140.82.121.3:443) was legitimate git traffic to GitHub for the monorepo sparse-checkout. This audit therefore assessed the skill descriptor only, not the installed software.

SKILL.md contains no instruction override attempts, no invisible unicode, no HTML comments, no base64-encoded instructions, no persona-switching directives, and no requests to suppress output. The document is straightforward technical documentation for a desktop automation tool.

Reads of .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and GCP credentials occurred at audit timestamps 1771918958 (pre-install baseline) and 1771918977 (post-install check). All reads are CLOSE_NOWRITE with no correlated outbound network data. Pattern matches Oathe's own canary integrity monitoring, not skill-originated access.