Claw Use — Device Control for AI Agents

• Analyzed: May 11, 2026, 6:52 AM
• Findings: 1
• Version: 1.0.0
• Hash: f410eb305bc1c5ed33528907bd4151790cbc90c1a35579cbef2229412565da31
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides instructions for an AI agent to use the 'cu' CLI tool for remote device control. While the functionality is transparently documented and aligned with its stated purpose, it introduces high-risk capabilities such as visual screen capture (cu screenshot), reading system notifications (cu notifications), and simulating user input or keystrokes (cu type, cu tap) on connected devices. These features represent a significant attack surface if the agent is manipulated, though no evidence of intentional malice, backdoors, or unauthorized data exfiltration was found in SKILL.md or _meta.json.