AmrDab/clawdcursor

Score 0. Found 12 critical, 14 high, 14 medium findings.

https://github.com/AmrDab/clawdcursorScanned April 29, 2026 at 12:18 PM

Scan another skill →

Trust score

0/ 100

Score 0. Found 12 critical, 14 high, 14 medium findings.

AmrDab/clawdcursor · 50 of 234 files read

Critical12

src/index.ts:155 · shell_exec
Spawns a subprocess.
```
const output = execSync(
```
src/index.ts:167 · shell_exec
Spawns a subprocess.
```
execSync(`taskkill /F /PID ${pid}`);
```

src/index.ts:177 · shell_exec

Spawns a subprocess.

execSync(`kill -9 $(lsof -ti tcp:${port})`, { shell: '/bin/sh' });

src/index.ts:926 · shell_exec

Spawns a subprocess.

execSync('npm unlink -g clawdcursor', { stdio: 'pipe', timeout: 15000 });

src/index.ts:972 · shell_exec
Spawns a subprocess.
```
const result = execFileSync('powershell.exe', [
```
src/index.ts:978 · shell_exec
Spawns a subprocess.
```
const result = execFileSync('osascript', ['-e',
```

src/index.ts:984 · shell_exec

Spawns a subprocess.

const output = execFileSync('xrandr', ['--query'], { timeout: 5000, encoding: 'utf-8' });

src/format.ts:19 · shell_exec

Spawns a subprocess.

const cp = execSync('chcp', { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });

+ 4 more

High14

src/server.ts:57 · skill_mismatch
SKILL.md claims read-only behavior, but code performs filesystem writes.
```
writeFileSync(TOKEN_PATH, token, { encoding: 'utf-8', mode: 0o600 });
```
src/server.ts:182 · skill_mismatch
SKILL.md claims read-only behavior, but code performs filesystem writes.
```
writeFileSync(FAVORITES_PATH, JSON.stringify(favorites, null, 2), 'utf-8');
```
src/server.ts:423 · skill_mismatch
SKILL.md claims read-only behavior, but code performs filesystem writes.
```
fs.writeFileSync(guidePath, JSON.stringify(raw, null, 2));
```
src/index.ts:118 · skill_mismatch
SKILL.md claims read-only behavior, but code performs filesystem writes.
```
fs.writeFileSync(pidFile, String(process.pid), { encoding: 'utf-8', mode: 0o600 });
```
src/index.ts:732 · skill_mismatch
SKILL.md claims read-only behavior, but code performs filesystem writes.
```
fs.writeFileSync(tmpScript, scriptContent);
```
src/index.ts:740 · skill_mismatch
SKILL.md claims read-only behavior, but code performs filesystem writes.
```
fs.writeFileSync(tmpScript, scriptContent, { mode: 0o755 });
```
src/index.ts:747 · skill_mismatch
SKILL.md claims read-only behavior, but code performs filesystem writes.
```
fs.writeFileSync(tmpScript, scriptContent, { mode: 0o755 });
```
src/index.ts:908 · skill_mismatch
SKILL.md claims read-only behavior, but code performs filesystem writes.
```
fs.writeFileSync(configPath, JSON.stringify(json, null, 2) + '\n');
```
+ 6 more

Medium14

src/server.ts:57 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
writeFileSync(TOKEN_PATH, token, { encoding: 'utf-8', mode: 0o600 });
```
src/server.ts:182 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
writeFileSync(FAVORITES_PATH, JSON.stringify(favorites, null, 2), 'utf-8');
```
src/server.ts:423 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
fs.writeFileSync(guidePath, JSON.stringify(raw, null, 2));
```
src/index.ts:118 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
fs.writeFileSync(pidFile, String(process.pid), { encoding: 'utf-8', mode: 0o600 });
```
src/index.ts:732 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
fs.writeFileSync(tmpScript, scriptContent);
```
src/index.ts:740 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
fs.writeFileSync(tmpScript, scriptContent, { mode: 0o755 });
```
src/index.ts:747 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
fs.writeFileSync(tmpScript, scriptContent, { mode: 0o755 });
```
src/index.ts:908 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
fs.writeFileSync(configPath, JSON.stringify(json, null, 2) + '\n');
```
+ 6 more

Verified by Novingly

Fix the findings. Earn the badge.

Skills scoring 90+ qualify for the Verified badge — a signed, embeddable trust signal for your README. Your score has room to move. We offer a done-for-you audit that files PRs directly against your repo.

View pricing→Request a DFY audit →