OpenClaw Cursor Agent — 技能工具
v1.0.0[自动翻译] Manage long-running Cursor CLI coding tasks through OpenClaw tools backed by tmux sessions. Use when the user asks to start a persistent coding job, i...
0· 257·1 当前·1 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's code and scripts generally match its stated purpose (managing tmux-backed Cursor tasks), but there are important mismatches and privilege/exposure risks you should be aware of before installing.
评估建议
What to check before installing:
- Understand the power: this skill runs shell scripts and the Cursor CLI in your filesystem and can modify project directories (it may run git commands, create files, push changes if instructed). Only install if you trust the code and intended tasks.
- Metadata mismatch: the package metadata claims no required binaries, but runtime scripts require bash, tmux, python3, and the Cursor CLI (agent). Expect to install/configure these first.
- Environment leakage: t...详细分析 ▾
ℹ 用途与能力
The plugin, JS entrypoint, and the included shell scripts are coherent with the described purpose: they spawn tmux sessions, run Cursor CLI, track status files, send commands, and kill sessions. However, the package metadata claims "Required binaries: none" whereas the runtime scripts and docs clearly require bash, tmux, python3, and the Cursor CLI (agent/cursor-agent). That metadata omission is an incoherence and could mislead users about runtime requirements.
⚠ 指令范围
SKILL.md and the included scripts instruct the agent to run local shell scripts that create task/runner/log/status files and execute Cursor CLI in project directories. Those scripts will run commands in user-specified project paths and can modify the project (git operations are part of recommended tasks). The Node extension spawns child processes with env: process.env (it forwards the entire environment) so any environment variables available to the agent are also visible to the scripts/child processes. The docs also include a restore script and backup download steps that would copy many files into ~/.openclaw if followed — a potentially destructive operation if executed without review.
✓ 安装机制
There is no external install spec (no arbitrary download/extract). The skill is instruction/code-only and includes local scripts and a Node entrypoint. No third-party URL downloads or installation of remote archives are present in the plugin files themselves (the docs show curl usage for installing Node/Cursor or downloading backups, which are standard but require user discretion).
⚠ 凭证需求
The skill declares no required environment variables or primary credentials, which superficially looks safe. In practice the Node code launches shell scripts with env: process.env (inheriting the agent process environment) and the scripts run external tools and may operate in arbitrary project directories. That means secrets present in the agent environment (AWS keys, tokens, etc.) could be visible to child processes or to any code the Cursor agent executes. Also the skill expects configuration (toolkitRoot) but that is not declared in the top-level 'required' metadata, increasing the chance of misconfiguration.
ℹ 持久化与权限
always is false. The skill writes state, task and log files under the configured toolkitRoot/status, tasks, and logs directories (normal for this functionality). It does not request to modify other skills or global agent settings. Nevertheless, scripts and the Cursor agent will be capable of making changes in target project directories (including git commits/pushes) — this is expected for a background coding agent but is a high-impact capability that users must accept explicitly.
⚠ extensions/openclaw-cursor-agent/index.js:175
Shell command execution detected (child_process).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/19
OpenClaw Cursor Agent 1.0.0 - Initial release with full support for managing persistent Cursor CLI coding tasks via OpenClaw tools and tmux sessions. - Supports starting, monitoring, sending commands to, and killing backend Cursor sessions. - Includes diagnostic tool to check environment and dependencies. - Provides natural language mappings for user instructions in both English and Chinese. - Outputs session and task IDs when spawning tasks; reports progress, current step, and tmux status when checking tasks. - Clear error reporting for missing dependencies (tmux, python3, agent, WSL).
● 可疑
安装命令 点击复制
官方npx clawhub@latest install openclaw-cursor-agent
镜像加速npx clawhub@latest install openclaw-cursor-agent --registry https://cn.clawhub-mirror.com
技能文档
让 OpenClaw 把长时间编码任务交给 Cursor CLI 在 tmux 里持久运行。
架构
用户（飞书/聊天） → OpenClaw Agent → 插件 → WSL → tmux → Cursor CLI Agent
可用工具
| 工具 | 说明 |
|---|---|
cursor_agent_spawn_task | 启动后台 Cursor 编码任务 |
cursor_agent_list_tasks | 列出所有任务 |
cursor_agent_check_status | 查询任务状态和进度 |
cursor_agent_send_command | 向任务发送补充指令 |
cursor_agent_kill_session | 结束任务 |
cursor_agent_doctor | 诊断环境和依赖 |
工作流程
- 环境不确定时先
cursor_agent_doctor检查 cursor_agent_spawn_task启动后台任务cursor_agent_check_status或cursor_agent_list_tasks监控进度cursor_agent_send_command发送补充指令（/pause、/resume、/status、或自然语言）cursor_agent_kill_session结束任务
自然语言映射
| 用户说 | 调用工具 |
|---|---|
| 帮我用 Cursor 在后台做一个任务：… | cursor_agent_spawn_task |
| 看看刚才那个任务做到哪了 | cursor_agent_check_status |
| 告诉刚才那个任务：改成 RS256 | cursor_agent_send_command |
| 把刚才那个 Cursor 任务停掉 | cursor_agent_kill_session |
| 列出所有后台任务 | cursor_agent_list_tasks |
| 检查 Cursor 环境是否正常 | cursor_agent_doctor |
输出规范
- spawn 后告知会话名和任务 ID
- 查状态时报告当前步骤、进度百分比、tmux 是否存活
- 环境缺依赖时明确指出缺少什么（tmux / python3 / agent / WSL）
参考文件
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制