33OUT OF 100
High riskDangerousStatic read

AmrDab/clawdcursor

The repository exhibits clear, documented behavior consistent with its stated purpose as an AI-driven desktop automation tool. The flagged install-time network activity and local IPC communication are explicitly described in the README and installation documentation. No malicious behavior was observed in our static read; full runtime behavior was not executed in a sandbox on this pass.

Repository size
7841 KB
Packages
0
Stars
403
Created
3 yr 2 mo
Reputation signals
AmrDab avatar
AmrDab
@AmrDab
Account age3 yr 2 mo
Public repos11
Forks59
Community sentiment85

Positive

Code & behavior signals
Install-time network/shell activity
MediumBehavior

The package.json contains a postinstall script that executes shell commands and network fetches. This is consistent with the project's documented installation method (curl | bash/ps1) and is expected for a cross-platform tool requiring native binary setup.

Local IPC and credential path usage
LowCode

The code references local loopback addresses (127.0.0.1) and a local token file (~/.clawdcursor/token). These are consistent with the project's architecture for local agent communication and are not indicative of external credential exfiltration.

Per-package scoring
Final verdict

Static analysis flagged behavior consistent with malware — install-time network/shell execution, credential access, or obfuscation. Runtime was not executed in a sandbox on this pass, so this is a static-read warning, not an observed detonation. Treat it as dangerous and run it only inside a fully disposable environment.

What we could not verify
—Full runtime behavior (this repo was not executed in a sandbox on this pass)
—Every conditional and time-triggered branch
—Behavior under real credentials (no sandbox was run on this pass)
End-to-end logs
Clone
›Cloned repository AmrDab/clawdcursor at commit 916ec8427fe6e65b80d30b71561449d36bdc8e8d
Static scan
›Detected postinstall hook in package.json
›Detected local IPC and token path references in scripts and documentation
Reputation
›Owner established for 3+ years
›403 stars indicates community adoption
Read
›Cross-referenced install-time network activity with README installation instructions
›Cross-referenced local IPC usage with project architecture documentation
Score
›Score computed by formula: 33/100 (deterministic, code-driven)
›-40 [code] install_time_network: Network/shell activity wired into an install-time hook (runs on install, before import).
›-8 [code] install_hook: A pre/post-install script is present (the surface install-time attacks hide in).
›-10 [code] model_findings: 2 code/behavior finding(s) reported by the read model.
›-6 [code] escalation_pending: Escalated past the fast read; not cleared by a runtime observation.
›+8 [reputation] established_owner: Owner account is established (older than a year with multiple public repos).
›+3 [reputation] some_stars: Some community signal (403 stars).
›+4 [reputation] good_sentiment: Positive community sentiment (85/100).
Escalation
›Escalation gate tripped on the static read
›Reason: install-time network/shell activity detected on static read
›Escalated to a deep behavioural read
Deep read
›The package installs a global command-line tool `clawdcursor` which sets up a local server for desktop automation. The `postinstall` script attempts to build and sign a native helper application on macOS, and verifies the Node.js version. The package aims to provide an AI agent with desktop control capabilities.
›[install/low] Installs a global command-line tool named `clawdcursor`. — evidence: package.json: `"bin": { "clawdcursor": "dist/surface/cli.js" }`
›[install/low] Executes a Node.js script `scripts/verify-install.js` during postinstall. — evidence: package.json: `"postinstall": "node scripts/verify-install.js || node -e \"process.exit(0)\" && node scripts/postinstall-native.js || node -e \"process.exit(0)\""`
›[install/low] Executes a Node.js script `scripts/postinstall-native.js` during postinstall. — evidence: package.json: `"postinstall": "node scripts/verify-install.js || node -e \"process.exit(0)\" && node scripts/postinstall-native.js || node -e \"process.exit(0)\""`
›[build/medium] On macOS, attempts to build and ad-hoc sign a native helper application using `native/build.sh` if Xcode Command Line Tools are installed. — evidence: package.json: `"setup": "... if(process.platform==='darwin'){const{execSync}=require('child_process');try{execSync('chmod +x native/build.sh && native/build.sh',{stdio:'inherit'})}catch(e){console.error('\n❌ Native build failed. Run manually: cd native && ./build.sh');process.exit(1)}}"` and `native/build.sh`
›[prerequisite-check/low] Checks if Node.js version is 20 or higher during installation via `docs/install.ps1` and `docs/install.sh`. — evidence: docs/install.ps1: `if ($major -lt 20) { ... }` and docs/install.sh: `if [ "$NODE_MAJOR" -lt 20 ]; then ... fi`
›[network/low] Communicates with a local server on `127.0.0.1:3847/mcp` or `127.0.0.1:3848` for JSON-RPC and other services. — evidence: README.md: `POST JSON-RPC to \`http://127.0.0.1:3847/mcp\``, `native/README.md: `localhost (\`127.0.0.1:3848\` by default)`
›[runtime/low] The `clawdcursor` CLI tool can start a daemon (`clawdcursor agent`) which serves HTTP and MCP on port 3847. — evidence: package.json: `"start": "node dist/surface/cli.js agent"` and docs/install.sh: `clawdcursor agent Start the daemon (HTTP + MCP on :3847)`
›[runtime/low] The `clawdcursor` CLI tool can be used to configure AI providers and models (`clawdcursor doctor`). — evidence: package.json: `"doctor": "node dist/surface/cli.js doctor"` and docs/install.sh: `clawdcursor doctor Configure AI provider + models`
›Not determinable without running the code:
› • The exact actions performed by `scripts/verify-install.js` and `scripts/postinstall-native.js` are not fully known without reading their contents. They are executed during `postinstall`.
› • The specific functionality of the native helper binaries (`ClawdCursorHost`, `clawdcursor-helper`, `screenshot-helper`, `permission-check`) is not fully detailed in the provided `build.sh` script, beyond their names suggesting desktop interaction and permissions.
› • The content fetched by `curl -fsSL https://clawdcursor.com/install.sh | bash` or `powershell -c "irm https://clawdcursor.com/install.ps1 | iex"` is not present in the repository, but the `docs/install.sh` and `docs/install.ps1` files are local copies of what would be fetched. These scripts perform global npm installation of the `clawdcursor` package.
›Read-only analysis: the code was NOT executed, so run-time-fetched payloads and run-time-built endpoints were not observed.
Auto-published at clauderabbit.in/AmrDab/clawdcursor · re-checked when the repo changes