Security audit

GUI Agent

Security checks for vulnerabilities and agentic risk

Overview

This GUI automation skill is mostly purpose-aligned, but it has review-worthy risks around insecure remote control, command-injection paths, broad screenshot retention, and OpenClaw session metadata access.

Install only if you are comfortable giving this skill broad desktop-control and screenshot access. Avoid using it on password managers, private chats, financial/account screens, or sensitive documents unless you first disable or regularly delete visual memory. Use remote mode only against trusted isolated VMs, not arbitrary HTTP endpoints, and prefer reviewing/fixing the shell=True and remote python3 -c command paths before using it with untrusted task parameters. Treat the setup as mutable because it installs latest packages and model artifacts without hashes.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/gui_agent.py:44
Finding: Shell Command Injection Through GUI Task Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/backends/http_remote.py:8
Finding: Remote Python Injection and Unauthenticated Plaintext VM Control
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/app_memory.py:2068
Finding: Unconditional Persistent Storage of Full-Screen and Full-Page Screenshots
Content: View full analysis
/ ├── meta.json ├── components.json ├── states.json ├── transitions.json ├── components/ └── pages/ # Full page screenshots ``` The Skill instructions reinforce broad automatic retention: ```text Save after every task — even failures teach about the site's UI ``` ```text ALWAYS save to memory — every GUI operation saves to memory/apps/ ``` ### Technical Analysis The learning workflow copies the complete source screenshot into persistent per-application or per-site storage. It also creates an annotated derivative. This occurs without content classification, sensitive-region redaction, explicit user consent, encryption, restrictive file-mode enforcement, or a documented retention deadline. The component-forgetting mechanism removes stale component templates but does not establish equivalent expiry or deletion for full-page screenshots. Reusing a page name may replace a prior image, but distinct page names can accumulate persistent screenshots. Because screenshots capture rendered screen content, they may include private messages, contact details, documents, account identifiers, financial information, browser content, notifications, or unmasked secrets. The project documentation itself acknowledges that visual m ...[truncated 1154 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: skills/gui-report/scripts/tracker.py:20
Finding: Performance Tracker Enumerates Global OpenClaw Session Metadata
Content: View full analysis
best_time: best_time = updated best_key = key return best_key except Exception: return None ``` ```python def _read_tokens(session_key=None): if not SESSIONS_FILE.exists(): return None try: with open(SESSIONS_FILE) as f: sessions = json.load(f) key = session_key or _find_session_key() if not key or key not in sessions: return None s = sessions[key] return { "totalTokens": s.get("totalTokens", 0), "inputTokens": s.get("inputTokens", 0), "outputTokens": s.get("outputTokens", 0), "cacheRead": s.get("cacheRead", 0), "cacheWrite": s.get("cacheWrite", 0), "contextTokens": s.get("contextTokens", 0), "sessionKey": key, } ``` ### Technical Analysis The reporting feature reads the global OpenClaw session index and iterates over all session entries to identify recent Discord-direct or main sessions. GUI au ...[truncated 1535 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:4
Finding: Unpinned and Unverified Third-Party Dependency Installation
Content: View full analysis
=8.3.0 opencv-python-headless>=4.8.0 numpy>=1.24.0 huggingface-hub transformers accelerate easyocr>=1.7.0 anthropic openai ``` The recommended setup script independently installs mutable latest versions: ```bash pip install -q --upgrade pip pip install -q torch torchvision torchaudio pip install -q ultralytics opencv-python-headless numpy pip install -q transformers accelerate huggingface-hub pip install -q anthropic openai ``` ### Technical Analysis Most dependencies have no version constraint, while others specify only a lower bound. No lockfile or package hashes are provided. The setup script also installs packages directly rather than using a reviewed, locked dependency set. A new setup can therefore resolve to materially different package versions over time. If an upstream release is compromised, removed and replaced, or introduces a vulnerable transitive dependency, users may install and execute it without any repository change. The audit did not identify a confirmed typosquatted package or known malicious dependency in the listed names. The finding concerns the unsafe and non-reproducible supply-chain process. ### Attack Path 1. A user follows the recommended setup process. 2. `pip` queries the configured package index for the latest versions satisfying broad or absent constraints. 3. The resolver downloads packages and transitive dependencies without project-supplied hash verification. 4. Package build hooks, installation logic, imports, or later runtime code execute under the user's account. 5. A compromised or unexpectedly changed upstream release gains the same local access as the GUI agent environment. ### Impact Assessment A malicious dependency could ...[truncated 444 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (266)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The finding indicates reads of session/token-related local files and writes of tracker/task history logs despite the skill presenting itself as GUI automation. Access to session artifacts and local memory stores can expose authentication data or sensitive operational history, and the mismatch means users may not realize the skill touches those files at all.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The finding indicates reads of session/token-related local files and writes of tracker/task history logs despite the skill presenting itself as GUI automation. Access to session artifacts and local memory stores can expose authentication data or sensitive operational history, and the mismatch means users may not realize the skill touches those files at all.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The finding indicates reads of session/token-related local files and writes of tracker/task history logs despite the skill presenting itself as GUI automation. Access to session artifacts and local memory stores can expose authentication data or sensitive operational history, and the mismatch means users may not realize the skill touches those files at all.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The finding indicates reads of session/token-related local files and writes of tracker/task history logs despite the skill presenting itself as GUI automation. Access to session artifacts and local memory stores can expose authentication data or sensitive operational history, and the mismatch means users may not realize the skill touches those files at all.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The finding indicates reads of session/token-related local files and writes of tracker/task history logs despite the skill presenting itself as GUI automation. Access to session artifacts and local memory stores can expose authentication data or sensitive operational history, and the mismatch means users may not realize the skill touches those files at all.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The finding indicates reads of session/token-related local files and writes of tracker/task history logs despite the skill presenting itself as GUI automation. Access to session artifacts and local memory stores can expose authentication data or sensitive operational history, and the mismatch means users may not realize the skill touches those files at all.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The finding indicates reads of session/token-related local files and writes of tracker/task history logs despite the skill presenting itself as GUI automation. Access to session artifacts and local memory stores can expose authentication data or sensitive operational history, and the mismatch means users may not realize the skill touches those files at all.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The finding indicates reads of session/token-related local files and writes of tracker/task history logs despite the skill presenting itself as GUI automation. Access to session artifacts and local memory stores can expose authentication data or sensitive operational history, and the mismatch means users may not realize the skill touches those files at all.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The finding indicates reads of session/token-related local files and writes of tracker/task history logs despite the skill presenting itself as GUI automation. Access to session artifacts and local memory stores can expose authentication data or sensitive operational history, and the mismatch means users may not realize the skill touches those files at all.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding indicates reads of session/token-related local files and writes of tracker/task history logs despite the skill presenting itself as GUI automation. Access to session artifacts and local memory stores can expose authentication data or sensitive operational history, and the mismatch means users may not realize the skill touches those files at all.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill metadata claims support for both macOS and Linux, but the action implementations rely heavily on macOS-specific tools such as osascript, System Events, screencapture, open -a, and /opt/homebrew/bin/cliclick. This mismatch can cause operators to run the skill in unsupported environments, leading to unsafe fallbacks, broken automation, or incorrect assumptions about what system capabilities are being invoked.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The quit_app action forcibly requests an application quit with no warning about unsaved work, no save-state check, and no confirmation step. In GUI automation, this creates a significant integrity and availability risk because it can cause immediate user data loss or interrupt critical tasks in the targeted application.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · benchmarks/osworld/multi_apps.md (reported line 40)May include surrounding context.
md
- These were only: VM reset → config download → mark score=0 **Blocked tasks** (cannot run): - Google Drive: #5, #6, #10, #11, #13, #14, #29, #33, #77, #99 (missing client_secrets.json) - Network: #28 (GitHub 403), #30 (anaconda timeout), #34-36 (web scraping), #47, #48, #53, #57, #66, #85, #95, #100, #101 ## Key Observations

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The code explicitly forwards the full inherited environment to child scripts. In an automation-agent setting, environment variables commonly hold secrets like API tokens, cloud credentials, SSH settings, and proxy authentication, so every called helper script and imported dependency gains access to those secrets, increasing the blast radius if any helper is compromised or logs/debugs its environment.
Content: Scanner excerpt · scripts/agent.py (reported line 231)May include surrounding context.
python
cmd = [VENV, str(SCRIPT_DIR / script_name)] + args_list try: r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout, env={**os.environ, "LANG": "en_US.UTF-8", "LC_ALL": "en_US.UTF-8"}) return r.stdout.strip(), r.returncode except subprocess.TimeoutExpired: return "Timeout", 1

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script enables remote GUI control over HTTP based only on a user-supplied URL, which expands the skill from local automation into network-delivered command execution against another host. In skill context, this is more dangerous because GUI actions can type secrets, click privileged dialogs, capture screenshots, and manipulate remote sessions without any visible authentication, transport-security, or scope restrictions in this interface.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The helper is a generic shell execution primitive with shell=True and is used to build commands from dynamic data. In this skill, which already has broad desktop control, successful parameter injection would escalate from GUI automation into unrestricted command execution on the host.
Content: Scanner excerpt · scripts/gui_agent.py (reported line 45)May include surrounding context.
python
return r.stdout.strip() def shell(cmd, timeout=15): r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout, env={**os.environ, "LANG": "en_US.UTF-8", "LC_ALL": "en_US.UTF-8"}) return r.stdout.strip()

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · scripts/gui_agent.py (reported line 46)May include surrounding context.
python
def shell(cmd, timeout=15): r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout, env={**os.environ, "LANG": "en_US.UTF-8", "LC_ALL": "en_US.UTF-8"}) return r.stdout.strip()

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · scripts/gui_agent.py (reported line 273)May include surrounding context.
python
def shell(cmd, timeout=15): r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout, env={**os.environ, "LANG": "en_US.UTF-8", "LC_ALL": "en_US.UTF-8"}) return r.stdout.strip()

YARA rule 'keylogger_indicators': Keylogger functionality in scripts or source code [malware]

High

Category: YARA Match
Confidence: 70% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · scripts/platform_input.py (reported line 108)May include surrounding context.
python
�═════════════════════════════════ # Keyboard operations (pynput) # ═══════════════════════════════════════════ # Map common key names to pynput Key objects def _resolve_key(name): """Resolve a key name string to pynput Key or KeyCode.""" from pynput.keyboard import Key, KeyCode key_map = { "return": Key.enter, "enter": Key.enter, "tab": Key.tab, "esc": Key.esc, "escape": Key.esc, "space": Key.space, "delete": Key.backspace, "backspace": Key.backspace, "fwd-delete": Key.delete, "up": Key.up, "arrow-up": Key.up, "down": Key.down, "arrow-down": Key.down, "left": Key.left, "arrow-left": Key.left, "right": Key.right, "arrow-right": Key.right, "home": Key.home, "end": Key.end, "page-up": Key.page_up, "page-down": Key.page_down,

YARA rule 'keylogger_indicators': Keylogger functionality in scripts or source code [malware]

High

Category: YARA Match
Confidence: 70% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · scripts/spreadsheet_utils.py (reported line 55)May include surrounding context.
python
e keyboard shortcut instead: # In Excel Mac: click Name Box = Cmd+F5 doesn't work reliably # Best approach: just press Ctrl+G or F5 for Go To dialog if app == "Microsoft Excel": # Excel Mac: use Ctrl+G to open Go To dialog, then type in Reference field key_press("escape") time.sleep(0.1) # Open Go To dialog with Ctrl+G (not Cmd+G!) from pynput.keyboard import Key, Controller as KBController kb = KBController() kb.press(Key.ctrl) kb.press('g') time.sleep(0.05) kb.release('g') kb.release(Key.ctrl) time.sleep(0.8) # Tab to the Reference field (it may not be focused by default) # Actually in Excel Mac Go To, the Reference field IS focused # But paste doesn't work there. Use type_text instead. # Clear any existing text first key_combo("command", "a") time.sleep(0.05) type_text(cell_ref) time.sleep(0

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · scripts/ui_detector.py (reported line 418)May include surrounding context.
python
r = subprocess.run( ["swift", swift_file, img_path], capture_output=True, text=True, env={**os.environ, "LANG": "en_US.UTF-8"} ) os.unlink(swift_file)

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The statement 'no privacy filtering needed' dismisses privacy safeguards in a workflow that processes screenshots and stores cropped interface elements. This increases the likelihood that sensitive or regulated data present in the UI will be retained without review, especially because the same document contemplates dynamic content removal only after capture has already occurred.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation describes remote screenshots, text input, and GUI control but does not warn users that screen contents and keystrokes may be transmitted to another machine or service. This omission undermines informed consent and increases the chance that sensitive data such as credentials, personal information, or proprietary content will be exposed during normal use.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The design expands a local GUI automation skill into remote device control over HTTP and SSH, which materially changes the trust and attack boundaries. That enables the agent to send clicks, keystrokes, window actions, and screenshots to external endpoints, creating a real risk of unauthorized remote control and data exposure beyond the stated local-only scope.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Remote HTTP control allows this skill to operate external GUI environments and retrieve screenshots over the network, which is a significant capability expansion from local automation. Without explicit scope declaration and security controls, this can lead to remote manipulation of systems and transmission of sensitive screen contents or typed data to untrusted services.
Content: No source excerpt is available for this finding.