wallpaper-auto-switch-pro-executable

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:09 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent macOS wallpaper utility, but its scripts contain confirmed command-injection risks and install a persistent LaunchAgent.

Review before installing. Only use trusted wallpaper directories and filenames, avoid paths containing shell or XML metacharacters, and do not install the LaunchAgent unless you understand it will keep running on a schedule. The unsafe scripting should be fixed before general use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/common.sh:8

Finding

Arbitrary Shell Command Execution Through Unsafe Path Expansion

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/common.sh:53

Finding

AppleScript Injection Through Malicious Image Filenames

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/install_launchagent.sh:18

Finding

LaunchAgent Plist Injection Through Unescaped Filesystem Paths

Content

View full analysis

"$LAUNCHD_PLIST" < Label ${LAUNCHD_LABEL} ProgramArguments /bin/bash ${SCRIPT_DIR}/rotate_once.sh ${DIR_PATH} StartInterval $((INTERVAL_MINUTES * 60)) RunAtLoad StandardOutPath ${HOME}/Library/Logs/${LAUNCHD_LABEL}.log StandardErrorPath ${HOME}/Library/Logs/${LAUNCHD_LABEL}.err.log PLIST ``` ### Technical Analysis The script creates an XML property list by directly interpolating `SCRIPT_DIR`, `DIR_PATH`, and `HOME` into XML text. XML metacharacters such as `&`, `<`, and `>` are not escaped. A macOS directory name can contain these metacharacters. A crafted existing wallpaper directory can therefore terminate the surrounding `` element and insert additional plist elements. Depending on the injected structure and property-list parser behavior, this can corrupt the configuration or introduce attacker-controlled launchd keys. The generated file is immediately passed to `launchctl bootstrap`, so no structural validation or inspection occurs between generation and attempted installation. ### Attack Path 1. An attacker creates or supplies an existing directory whose name contains crafted XML markup. 2. The user or agent invokes `install_launchagent.sh` with that directory. 3. `ensure_dir_exists` accepts it because it is a real directory. 4. The raw path is interpolated into the `${DIR_PATH} ...[truncated 908 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (32)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

声明的核心功能是“立即换壁纸”或“安装定时轮换任务”，而该代码片段的实际功能只是读取本地目录、收集图片、统计数量并打印示例文件名。这属于与声明主目的明显不一致：代码没有调用任何 macOS 壁纸设置机制，也没有创建、写入或加载 launchd 配置。虽然访问本地壁纸目录与该技能主题相关，但这里只体现为辅助性的图片清单检查脚本，不能代表声明中的主要能力，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger phrases for immediate execution are broad everyday language and directly map user utterances to a local command that changes system state. In an agent setting, overly permissive triggers increase the chance of accidental activation or prompt-induced execution without a sufficiently explicit confirmation boundary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The folder-check phrases are somewhat ambiguous and can cause the agent to inspect arbitrary local directories based on loosely phrased requests. While the action is read-oriented rather than destructive, it still broadens access to local file metadata and can normalize execution on unclear intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

These broad install/uninstall automation triggers authorize creation or removal of a persistent launchd job from common-language requests. Persistence mechanisms are security-sensitive because they survive the current session and can be abused or triggered accidentally if the agent does not enforce explicit consent and precise scoping.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The skill explicitly supports writing a launchd plist under the user's LaunchAgents directory, which establishes session persistence. Although persistence is the stated feature rather than covert behavior, persistence itself is security-relevant because it causes recurring execution and can be repurposed if the installed command or target path is not tightly controlled.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

输出：
1. 壁纸目录
2. 轮换间隔（分钟）
3. launchd plist 路径
4. 是否安装成功
5. 如何卸载

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 70)May include surrounding context.

md

SUPPORTED_EXTENSIONS=(jpg jpeg png heic webp)
LAUNCHD_LABEL="com.openclaw.wallpaperrotator"
LAUNCHD_PLIST="$HOME/Library/LaunchAgents/${LAUNCHD_LABEL}.plist"

expand_path() {
  local input="$1"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/common.sh (reported line 6)May include surrounding context.

sh

SUPPORTED_EXTENSIONS=(jpg jpeg png heic webp)
LAUNCHD_LABEL="com.openclaw.wallpaperrotator"
LAUNCHD_PLIST="$HOME/Library/LaunchAgents/${LAUNCHD_LABEL}.plist"

expand_path() {
  local input="$1"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install_launchagent.sh (reported line 20)May include surrounding context.

sh

SUPPORTED_EXTENSIONS=(jpg jpeg png heic webp)
LAUNCHD_LABEL="com.openclaw.wallpaperrotator"
LAUNCHD_PLIST="$HOME/Library/LaunchAgents/${LAUNCHD_LABEL}.plist"

expand_path() {
  local input="$1"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install_launchagent.sh (reported line 21)May include surrounding context.

sh

SUPPORTED_EXTENSIONS=(jpg jpeg png heic webp)
LAUNCHD_LABEL="com.openclaw.wallpaperrotator"
LAUNCHD_PLIST="$HOME/Library/LaunchAgents/${LAUNCHD_LABEL}.plist"

expand_path() {
  local input="$1"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install_launchagent.sh (reported line 40)May include surrounding context.

sh

SUPPORTED_EXTENSIONS=(jpg jpeg png heic webp)
LAUNCHD_LABEL="com.openclaw.wallpaperrotator"
LAUNCHD_PLIST="$HOME/Library/LaunchAgents/${LAUNCHD_LABEL}.plist"

expand_path() {
  local input="$1"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install_launchagent.sh (reported line 51)May include surrounding context.

sh

SUPPORTED_EXTENSIONS=(jpg jpeg png heic webp)
LAUNCHD_LABEL="com.openclaw.wallpaperrotator"
LAUNCHD_PLIST="$HOME/Library/LaunchAgents/${LAUNCHD_LABEL}.plist"

expand_path() {
  local input="$1"

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The expand_path function uses eval on attacker-controlled input, which can trigger shell command execution during path expansion. In a skill that only needs to resolve local wallpaper paths, eval is unnecessary and materially increases risk because crafted input such as command substitution or shell metacharacters could execute arbitrary commands under the user's account.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The error message is hardcoded in Chinese, which forces a specific language for user-facing output without any opt-in or documented locale constraint. This can violate language/locale policy when the skill is intended for general use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The error message is hardcoded in Chinese, which forces a specific language for user-facing output without any opt-in or documented locale constraint. This can violate language/locale policy when the skill is intended for general use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The error message is hardcoded in Chinese, which forces a specific language for user-facing output without any opt-in or documented locale constraint. This can violate language/locale policy when the skill is intended for general use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This shell script emits user-facing status and error text in Chinese, which imposes a specific language on all users. The file does not provide any opt-in, fallback, or justification for the locale restriction, so it conflicts with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

Writing a LaunchAgent plist into ~/Library/LaunchAgents is a persistence mechanism, because it prepares recurring execution under launchd for the current user. Although this aligns with the skill's stated purpose, persistence always increases attack surface if the plist or referenced script can be modified after installation.

Content

Scanner excerpt · scripts/install_launchagent.sh (reported line 18)May include surrounding context.

sh

mkdir -p "$HOME/Library/LaunchAgents"

cat > "$LAUNCHD_PLIST" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The script unloads any existing agent and bootstraps the new plist into the user's launchd domain, activating persistence immediately. In context this is expected functionality, but it remains security-sensitive because it registers recurring execution without additional integrity checks on the referenced script.

Content

Scanner excerpt · scripts/install_launchagent.sh (reported line 41)May include surrounding context.

sh

<string>${HOME}/Library/Logs/${LAUNCHD_LABEL}.err.log</string>
</dict>
</plist>
PLIST

launchctl bootout "gui/$(id -u)" "$LAUNCHD_PLIST" >/dev/null 2>&1 || true
launchctl bootstrap "gui/$(id -u)" "$LAUNCHD_PLIST"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

Enabling the launchd label makes the persistent agent active across future sessions, which is a classic persistence mechanism. The skill context makes this less suspicious than in unrelated software, but it is still a real persistence capability that could be leveraged if the installed components are replaced or modified.

Content

Scanner excerpt · scripts/install_launchagent.sh (reported line 43)May include surrounding context.

sh

</plist>
PLIST

launchctl bootout "gui/$(id -u)" "$LAUNCHD_PLIST" >/dev/null 2>&1 || true
launchctl bootstrap "gui/$(id -u)" "$LAUNCHD_PLIST"
launchctl enable "gui/$(id -u)/${LAUNCHD_LABEL}" >/dev/null 2>&1 || true
launchctl kickstart -k "gui/$(id -u)/${LAUNCHD_LABEL}" >/dev/null 2>&1 || true

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Kickstarting the label forces immediate execution of the persistent LaunchAgent, reducing the time between installation and code execution. In a wallpaper utility this is expected, but from a security perspective it means any unsafe or tampered referenced script runs right away under the user's session.

Content

Scanner excerpt · scripts/install_launchagent.sh (reported line 44)May include surrounding context.

sh

PLIST

launchctl bootout "gui/$(id -u)" "$LAUNCHD_PLIST" >/dev/null 2>&1 || true
launchctl bootstrap "gui/$(id -u)" "$LAUNCHD_PLIST"
launchctl enable "gui/$(id -u)/${LAUNCHD_LABEL}" >/dev/null 2>&1 || true
launchctl kickstart -k "gui/$(id -u)/${LAUNCHD_LABEL}" >/dev/null 2>&1 || true

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The script explicitly enables a per-user launchd agent, creating session persistence that will automatically run on login and at intervals. In this skill's context, persistence is the intended feature for wallpaper rotation, but it is still security-relevant because it establishes recurring execution from a user-writable location and could be abused if the referenced script or directory is later tampered with.

Content

Scanner excerpt · scripts/install_launchagent.sh (reported line 45)May include surrounding context.

sh

launchctl bootout "gui/$(id -u)" "$LAUNCHD_PLIST" >/dev/null 2>&1 || true
launchctl bootstrap "gui/$(id -u)" "$LAUNCHD_PLIST"
launchctl enable "gui/$(id -u)/${LAUNCHD_LABEL}" >/dev/null 2>&1 || true
launchctl kickstart -k "gui/$(id -u)/${LAUNCHD_LABEL}" >/dev/null 2>&1 || true

echo "状态: 成功"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script emits user-facing status messages entirely in Chinese (for example at L14, L15, L18, and L22). This imposes a specific language on all users without opt-in or any documented justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/common.sh (reported line 6)May include surrounding context.

sh

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
source "$SCRIPT_DIR/common.sh"

launchctl bootout "gui/$(id -u)" "$LAUNCHD_PLIST" >/dev/null 2>&1 || true
rm -f "$LAUNCHD_PLIST"

echo "状态: 成功"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install_launchagent.sh (reported line 20)May include surrounding context.

sh

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
source "$SCRIPT_DIR/common.sh"

launchctl bootout "gui/$(id -u)" "$LAUNCHD_PLIST" >/dev/null 2>&1 || true
rm -f "$LAUNCHD_PLIST"

echo "状态: 成功"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install_launchagent.sh (reported line 51)May include surrounding context.

sh

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
source "$SCRIPT_DIR/common.sh"

launchctl bootout "gui/$(id -u)" "$LAUNCHD_PLIST" >/dev/null 2>&1 || true
rm -f "$LAUNCHD_PLIST"

echo "状态: 成功"