T09 · Insecure Skill Coding Practices
Warning
- Location
- __init__.py:128
- Finding
- Approval and safety controls do not cover all sensitive desktop operations<![CDATA[ ## Vulnerability Details **File Location**: `__init__.py:128-141`, `__init__.py:197-205`, `__init__.py:210-228`, and `__init__.py:348-380` **Vulnerability Type**: Incomplete authorization enforcement and missing input validation **Risk Level**: Medium ### Vulnerable Code ```python def scroll(self, clicks: int, direction: str = 'vertical', x: Optional[int] = None, y: Optional[int] = None) -> None: """ Scroll mouse wheel. Args: clicks: Scroll amount (+ = up/left, - = down/right) direction: 'vertical' or 'horizontal' x, y: Position to scroll at (None = current position) """ if x is not None and y is not None: pyautogui.moveTo(x, y) if direction == 'vertical': pyautogui.scroll(clicks) else: pyautogui.hscroll(clicks) logger.debug(f"Scrolled {direction} {clicks} clicks") ``` ```python def key_down(self, key: str) -> None: """Press and hold a key without releasing.""" pyautogui.keyDown(key) logger.debug(f"Key down: '{key}'") def key_up(self, key: str) -> None: """Release a held key.""" pyautogui.keyUp(key) logger.debug(f"Key up: '{key}'") ``` ```python def screenshot(self, region: Optional[Tuple[int, int, int, int]] = None, filename: Optional[str] = None): """ Capture screen or region. Args: region: (left, top, width, height) for partial capture filename: Path to save image (None = return PIL Image) Returns: PIL Image object (if filename is None) """ img = pyautogui.screenshot(region=region) if filename: img.save(filename) logger.info(f"Screenshot saved to: {filename}") else: logger.debug(f"Screenshot captured (region={region})") return img ``` ```python def copy_to_clipboard(self, text: str) -> None: """ Copy text to clipboard. Args: text: Text to copy """ try: import pyperclip pyperclip.c ...[truncated 2832 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Apply `_check_approval()` to every state-changing or privacy-sensitive operation, including: - `scroll` - `key_down` - `key_up` - `screenshot` - `get_pixel_color` - `find_on_screen` - `copy_to_clipboard` - `get_from_clipboard` - Window enumeration and activation where appropriate 2. Use a centralized authorization decorator or internal dispatcher so newly added methods cannot accidentally omit approval checks. 3. Validate coordinates against the active display topology before passing them to PyAutoGUI. 4. Validate screenshot regions for positive dimensions and permitted screen boundaries. 5. Restrict `direction`, mouse-button, and key parameters to explicit allowlists. 6. Add upper bounds for click counts, scroll amounts, key repetitions, durations, and screenshot dimensions. 7. Expose `require_approval` in `AIDesktopAgent.__init__` and enable it by default for autonomous workflows. 8. Separate read consent from action consent so users can independently control screen capture, clipboard access, and input generation. 9. Add tests confirming that every sensitive method is blocked when approval is declined. ]]>