Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Desktop Control Custom
v1.0.0Advanced desktop automation with mouse, keyboard, and screen control
⭐ 0· 93·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The code and SKILL.md implement desktop automation (pyautogui, screenshots, window management, clipboard) and an autonomous AI agent for planning—this matches the stated purpose. Minor inconsistencies: registry metadata (slug/ownerId) does not match the included _meta.json, and the package/module import paths (skills.desktop_control vs desktop_control) differ from the registry slug 'desktop-control-custom'. These are likely packaging/metadata issues but worth confirming before installation.
Instruction Scope
Runtime instructions focus on installing desktop automation dependencies and using the DesktopController/AIDesktopAgent APIs. The skill instructs the agent to capture screenshots, read/modify the clipboard, list and activate windows, and control mouse/keyboard — all expected for this purpose. There are no instructions to read unrelated system credentials or to transmit data to external endpoints.
Install Mechanism
No automated install spec is included in the registry (files are shipped with the skill). SKILL.md recommends installing dependencies with pip (pyautogui, pillow, opencv-python, pygetwindow, etc.). There are no downloads from obscure URLs or extract steps in the registry metadata; this is low-risk, but note the user must run pip installs themselves.
Credentials
The skill declares no required environment variables, credentials, or config paths. The functionality (desktop control, screenshots, clipboard) does not require external secrets. This is proportional to the described features.
Persistence & Privilege
always:false (normal). The skill includes an autonomous AI agent (ai_agent.py) capable of planning and executing sequences of desktop actions and capturing screenshots. Autonomous invocation is the platform default; combined with the agent's capabilities this raises expected privacy/impact considerations (it can act on the user's desktop and capture screen contents). This is coherent with the skill's purpose but worth caution.
Assessment
Plain-language checklist before installing:
- Function matches description: This skill will control your mouse/keyboard, take screenshots, read/write the clipboard, and can run planned/automated tasks. That's expected for a desktop-automation skill.
- Metadata and packaging: The registry metadata (owner/slug) and the included _meta.json/module names differ. Confirm which package/module path you should import (e.g., 'desktop_control' vs 'skills.desktop_control') and that the publisher is who you expect.
- Privacy & safety: The AI agent can capture screenshots and clipboard contents. Don’t run it while sensitive documents, password managers, banking sessions, or other private material are visible.
- Failsafe & approval: Use failsafe=True and consider require_approval=True while testing so you can abort (move mouse to corner). Test demos in a disposable VM or a non-critical account first.
- Installation: SKILL.md recommends pip installing third-party packages. Review those packages and install them in a virtualenv. The skill does not pull code from remote URLs at install time.
- Autonomous use: If you plan to let the agent run autonomously, restrict what tasks it can run and monitor its action history/snapshots. Don’t give it long-running, unsupervised permissions on a machine with sensitive data.
- If unsure: Run the demo scripts first to verify behavior, or inspect the remaining truncated code paths for any network calls before granting broad usage.
If you want, I can list the exact lines/files that show screenshot/clipboard access, or scan the remaining truncated portions for network/shell calls before you install.Like a lobster shell, security has layers — review code before you run it.
latestvk97a84w41kzp6f22hsz6w6abbh83dkrv
License
MIT-0
Free to use, modify, and redistribute. No attribution required.