Back to skill

Security audit

Desktop Control Custom

Security checks for vulnerabilities and agentic risk

Overview

This desktop automation skill does what it says, but it gives broad control over your screen, keyboard, mouse, windows, and clipboard with weak default safeguards.

Install only if you are comfortable granting an agent live control of your desktop. Use it in a controlled environment, keep failsafe enabled, avoid sensitive screens and clipboard contents, do not run it as administrator unless necessary, and prefer explicit approval or code review before using autonomous workflows.

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
__init__.py:128
Finding

Approval and safety controls do not cover all sensitive desktop operations

Content
View full analysis
None: """ Scroll mouse wheel. Args: clicks: Scroll amount (+ = up/left, - = down/right) direction: 'vertical' or 'horizontal' x, y: Position to scroll at (None = current position) """ if x is not None and y is not None: pyautogui.moveTo(x, y) if direction == 'vertical': pyautogui.scroll(clicks) else: pyautogui.hscroll(clicks) logger.debug(f"Scrolled {direction} {clicks} clicks") ``` ```python def key_down(self, key: str) -> None: """Press and hold a key without releasing.""" pyautogui.keyDown(key) logger.debug(f"Key down: '{key}'") def key_up(self, key: str) -> None: """Release a held key.""" pyautogui.keyUp(key) logger.debug(f"Key up: '{key}'") ``` ```python def screenshot(self, region: Optional[Tuple[int, int, int, int]] = None, filename: Optional[str] = None): """ Capture screen or region. Args: region: (left, top, width, height) for partial capture filename: Path to save image (None = return PIL Image) Returns: PIL Image object (if filename is None) """ img = pyautogui.screenshot(region=region) if filename: img.save(filename) logger.info(f"Screenshot saved to: {filename}") else: logger.debug(f"Screenshot captured (region={region})") return img ``` ```python def copy_to_clipboard(self, text: str) -> None: """ Copy text to clipboard. Args: text: Text to copy """ try: import pyperclip pyperclip.c ...[truncated 2832 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
__init__.py:168
Finding

Typed and clipboard content is recorded in application logs

Content
View full analysis
50 else ''}' (interval={interval:.3f}s)") ``` ```python def copy_to_clipboard(self, text: str) -> None: """ Copy text to clipboard. Args: text: Text to copy """ try: import pyperclip pyperclip.copy(text) logger.info(f"Copied to clipboard: '{text[:50]}...'") except ImportError: logger.error("pyperclip not installed. Run: pip install pyperclip") except Exception as e: logger.error(f"Error copying to clipboard: {e}") ``` ```python def get_from_clipboard(self) -> Optional[str]: """ Get text from clipboard. Returns: Clipboard text, or None if error """ try: import pyperclip text = pyperclip.paste() logger.debug(f"Got from clipboard: '{text[:50]}...'") return text except ImportError: logger.error("pyperclip not installed. Run: pip install pyperclip") return None except Exception as e: logger.error(f"Error getting clipboard: {e}") return None ``` ### Technical Analysis The controller records up to the first 50 characters of typed and clipboard content. Desktop automation commonly handles passwords, API tokens, recovery codes, private messages, personal information, and other confidential values. The module calls `logging.basicConfig(level=logging.INFO)` during import. Therefore, typed and copied values are exposed at the default logging level. Clipboard reads are logged at debug level and become visible whenever verbose logging is enabled. Truncating the value does not provide ...[truncated 1402 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:618
Finding

Installation instructions use unpinned third-party dependencies

Content
View full analysis
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (21)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation says the agent observes the screen and takes screenshots, but it does not clearly warn that sensitive on-screen information may be captured, stored, or exposed during execution. In a desktop automation skill, screenshots can contain credentials, personal data, internal documents, or other secrets, making silent capture a meaningful privacy and security risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The guide includes examples like posting to Instagram and filling applications, but it omits a warning that the agent may submit user data to third-party websites or services. This is dangerous because autonomous form submission can leak personal information, publish content unintentionally, or perform irreversible actions on external accounts.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill’s declared description emphasizes mouse, keyboard, and screen control, but the documented capabilities also include window enumeration/activation, clipboard read/write access, and interactive approval prompts. This mismatch can cause underestimation of the skill’s access to potentially sensitive UI state and user data, increasing the chance of unsafe deployment or overbroad trust.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Screenshot capture can collect sensitive on-screen data including emails, documents, credentials, chats, MFA prompts, and other private content without notice or consent. Saving captures to disk further increases risk by creating durable artifacts that can be exfiltrated or discovered later.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The global helper functions create a controller with default require_approval=False, making privileged desktop actions one-call accessible with no confirmation. This weakens the only built-in consent mechanism and makes accidental or malicious use of mouse, keyboard, and screen control significantly easier in an agent-driven environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill advertises very broad natural-language autonomy such as understanding what the user wants and figuring out how to do it autonomously, without defining clear task boundaries or approval gates. In a desktop-control context, vague activation scope is dangerous because users may trigger unintended actions across applications, files, and websites with ambiguous prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The examples for file operations and automated workflows imply the agent may copy, open, save, or otherwise manipulate files without warning users about the risk of unintended modification, overwrite, or propagation of sensitive data. In an autonomous desktop agent, such operations can damage user data or move confidential files to unsafe locations if the plan is wrong.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guide states in present tense that the agent can analyze screenshots, detect UI elements, read text via OCR, and identify objects, and even shows a callable _analyze_screen() example. However, the later 'Future Enhancements' section lists computer vision and LLM integration as planned features, which directly contradicts the earlier documentation about existing capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The guide presents disabling failsafe as a simple performance option without warning that it removes an emergency interruption mechanism during autonomous mouse and keyboard control. If the agent misbehaves, users may lose the ability to quickly stop destructive or privacy-impacting actions, increasing the chance of cascading harm.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The examples include actions like form submission, window switching, file selection/copying, search-and-replace, launching applications, and clipboard transfer without warning that these operations can alter user data, leak sensitive content, or affect the active desktop unpredictably. In GUI automation, examples are often copied verbatim, so omitting guardrails can lead to destructive or privacy-impacting behavior in real environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The quick reference explicitly shows DesktopController(failsafe=False) and labels it as maximum speed, which normalizes disabling an important safety control without a strong warning. In a desktop automation skill, removing failsafes increases the chance of runaway automation, accidental clicks/typing, and unintended interaction with sensitive applications or system dialogs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The feature list advertises screenshots, image recognition, color detection, and clipboard operations without any prominent warning that these functions may capture passwords, tokens, personal messages, or other sensitive on-screen/clipboard data. In a desktop automation context, these are high-sensitivity capabilities because they can expose private information from unrelated applications on the user’s desktop.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The examples demonstrate actions that can change system or file state, such as drag-and-drop file movement, multi-file selection and copy operations, form submission, and application interaction, without warning that automation mistakes may move, overwrite, submit, or disclose data unintentionally. In a desktop-control skill, seemingly simple examples can be copied directly into real environments where coordinate mistakes or focus errors affect the wrong window or file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The scroll method performs live desktop input without passing through the approval gate used by some other actions. In an agent context, even simple scrolling can manipulate active applications, reveal hidden content, confirm hover-driven UI state changes, or assist broader automated workflows without user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The key_down and key_up methods bypass approval and can hold modifier keys or trigger unintended shortcuts in the focused application. This can be chained with other methods to automate destructive or stealthy actions, especially because focus may already be on a sensitive window.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description promises mouse, keyboard, and screen control, but the implementation also provides window enumeration/activation and clipboard read/write. This capability expansion increases the attack surface and can expose or modify sensitive user context beyond what a caller might reasonably expect from the declared purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Activating a window changes user focus and can redirect subsequent keystrokes or clicks into a different application than the user expects. In combination with typing, hotkeys, clipboard, or screenshots, this materially increases the chance of unauthorized actions or data exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Clipboard access is not clearly justified by the stated desktop-control purpose and enables both reading and overwriting potentially sensitive transient data such as passwords, tokens, copied documents, or wallet addresses. Hidden clipboard access is especially risky because users often do not expect it and may not notice compromise or data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Clipboard writes can silently replace user-copied data, causing accidental leakage, transaction redirection, or corruption of the user's workflow. Because clipboard contents are often trusted and pasted later into sensitive apps, unauthorized modification can have downstream security effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The agent automatically captures screenshots before and after each step and stores them in the returned result structure without any explicit user consent, warning, or data minimization. In a desktop automation context, screenshots can contain sensitive information from unrelated windows, credentials, messages, or documents, so silent collection materially increases privacy and data-exposure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code writes screenshots to disk using a caller-controlled filename without an explicit warning that screen contents are being persisted. Persisted screenshots create a longer-lived copy of potentially sensitive desktop data, increasing the chance of later disclosure through local access, backups, sync tools, or log/artifact collection.

Content

No source excerpt is available for this finding.