Windows Host UI Bridge

What to consider before installing: - This skill instructs the agent to run Windows cmd.exe from WSL and to call npx to fetch and run the package @midscene/computer@1 on the Windows host. That means it will download and execute code on your Windows machine at runtime — treat that like installing software from an untrusted source. - The SKILL.md asks the agent to ‘sanitize’ prompts by removing a few characters, but the blacklist is incomplete. Malicious or malformed input could still trigger arbitrary commands on the host. - There is an explicit mismatch: the skill declares 'node' as a required binary on the Linux side but the runtime command uses a Windows npx path. Ask the author why a Linux node is required or whether the template is accurate. - If you consider using this skill: require the package author to provide provenance (repository, homepage, signed release, checksum), avoid runtime npx of unpinned packages, and prefer a vetted binary or an explicit install step you control. Limit autonomous invocation (require explicit user confirmation), test in an isolated disposable WSL/Windows environment, and audit the @midscene/computer package source before granting access. - If you cannot verify the remote package and the author’s intent, treat the skill as high-risk and avoid installing it on productive machines.