Use Cursor

Manage Cursor CLI tasks via tmux with security hardening

This skill appears to do exactly what it claims: run Cursor CLI inside tmux sessions and return output. Before installing or using it, consider: 1) Run it first in isolated mode (spawn-isolated or inside a container) to avoid leaking environment variables or workspace secrets. 2) Review the included scripts (scripts/*.sh) yourself — the skill intentionally executes shell commands and uses tmux send-keys, which can execute input if a shell is active in the pane. 3) Don't run untrusted task strings on production machines with high-value secrets; use the provided isolation/container guidance. 4) Understand that redaction is pattern-based and may not catch every secret — if you have unusual credential formats, test outputs in a safe environment. If you need to be extra cautious, require manual approval before the skill invokes tools or runs tasks.

Type: OpenClaw Skill Name: use-cursor Version: 1.0.11 The skill provides tools to manage the Cursor CLI via tmux, which involves high-risk behaviors like shell execution (child_process.exec) and sending keys to terminal sessions. While the author has implemented significant security hardening—including a custom shell escaping function that strips control characters (index.js), the use of tmux literal mode (-l flag) in all scripts (spawn.sh, send.sh), and automated redaction of emails and API keys—the inherent risk of shell injection and the ability to capture workspace data from tmux panes requires a cautious classification for manual review.