wallpaper-auto-switch-pro-executable
WarnAudited by ClawScan on May 18, 2026.
Overview
The skill’s wallpaper and launchd behavior is mostly purpose-aligned, but its path handling can allow unintended local command execution and should be reviewed before use.
Use this only after fixing or reviewing the unsafe path handling. If installed, it will create a user-level launchd task that keeps rotating wallpapers until you run the uninstall script.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A malicious or malformed wallpaper folder path could run unintended commands on the user's Mac.
The script uses eval on a user-supplied directory argument when it begins with ~. A crafted path containing shell metacharacters could execute arbitrary shell commands as the current user.
if [[ "$input" == ~* ]]; then
eval "printf '%s' $input"Remove eval and implement safe tilde expansion, for example only translating exactly '~' or '~/...' to $HOME, and reject paths containing unsafe control characters.
A specially named image file in the wallpaper folder could cause the wallpaper change command to fail or run unintended AppleScript behavior.
The selected file path is interpolated directly into an AppleScript string without escaping. Wallpaper filenames containing quotes or newlines could break the script syntax and potentially inject AppleScript commands.
set targetFile to POSIX file "$file"
Pass file paths to osascript through argv or escape AppleScript string values safely before interpolation.
The skill can keep running after installation to change wallpapers automatically until the LaunchAgent is removed.
The install script creates a launchd job that persists and runs automatically on an interval. This is disclosed and aligned with the wallpaper rotation purpose, but users should notice the persistence.
<key>StartInterval</key> <integer>$((INTERVAL_MINUTES * 60))</integer> <key>RunAtLoad</key> <true/>
Install the LaunchAgent only if recurring wallpaper changes are desired, and use the provided uninstall script to stop it.
The skill may not work as installed on some Macs even if the declared gshuf dependency is present.
The registry requirements list gshuf, while the script calls shuf. On macOS this mismatch can cause failure or require a local alias/wrapper.
printf '%s ' "$list" | shuf -n 1
Update the dependency declaration or script to consistently use the same shuffle binary, and verify required tools before running.