windows-ui-controller

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:14 AM UTC
• Version: 1.0.0

Overview

This skill teaches an agent to control real Windows apps, including messaging and cloud-storage apps, but its scope and safety controls are too broad for automatic trust.

Install only if you intentionally want an agent to automate your Windows desktop. Use it under a standard user account, avoid sensitive apps unless you explicitly direct each action, verify the target window before clicks or typing, and pin or review the pywinauto dependency before installation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:10-18
Related Locations: SKILL.md:46-53, SKILL.md:63-64, README.md:31-34, README.md:50-52
Vulnerability Type: Unpinned and mutable third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

"requires": { "bins": ["python"] },
"install":
  [
    {
      "id": "pywinauto",
      "kind": "pip",
      "package": "pywinauto",
      "label": "Install pywinauto (pip)",
    },
  ],

The associated installation instructions execute:

bash

pip install pywinauto

The documented offline alternative is:

bash

cd dependencies
pip install --no-index --find-links=. pywinauto

However, the audited project contains only README.md and SKILL.md; the documented dependencies directory and wheel files are not present.

Technical Analysis

The installation metadata and documentation identify the dependency only by package name, without an exact version, cryptographic hash, or lock file. As a result, installation resolves whichever release the configured Python package index considers current at execution time. The installed artifact can therefore differ from the artifact that existed when this skill was reviewed.

Python package installation is a code-execution boundary. A compromised package-index account, malicious package release, compromised distribution artifact, or unexpected future dependency change could introduce code that executes during installation or when imported. This risk is amplified because the dependency is intended to control arbitrary Windows application interfaces.

The offline installation instructions do not mitigate the issue in the audited artifact because the claimed local wheel directory is absent. Even if wheels were later supplied, installing by package name without requiring hashes would not independently establish their integrity.

Attack Path

1. An attacker compromise ...[truncated 1111 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an explicitly reviewed version, for example pywinauto==0.6.9.
2. Generate a lock file containing all transitive dependencies and exact versions.
3. Require cryptographic hashes during installation, such as with a hash-pinned requirements file and pip install --require-hashes.
4. Obtain packages only from an explicitly configured trusted index over TLS.
5. If offline installation is advertised, include the reviewed wheel files in the package and publish SHA-256 hashes for each artifact.
6. Ensure the wheel versions and Python ABI tags match the documented supported Python versions.
7. Install dependencies inside a dedicated virtual environment under a standard user account.
8. Add automated dependency vulnerability and integrity scanning to the release process.
9. Remove the offline-installation instructions if the corresponding verified artifacts are not distributed with the project.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: README.md:243

Finding

Overbroad Recommendation to Run UI Automation with Administrator Privileges

Content

View full analysis

Vulnerability Details

File Location: README.md:243-248
Related Locations: README.md:66, README.md:289, README.md:471
Vulnerability Type: Violation of least privilege through generic elevation guidance
Risk Level: Medium

Vulnerable Documentation

The affected section states, in English translation:

text

Problem: Some software requires administrator privileges.

Solution: Run Python as administrator.

Windows context menu → Run as administrator

Similar guidance is repeated when troubleshooting inaccessible controls and unresponsive clicks.

Technical Analysis

The tutorial recommends elevating the entire Python interpreter as a general solution when an application or control cannot be accessed. This expands the privilege boundary for all code loaded into that interpreter, including pywinauto, its transitive dependencies, user-provided automation scripts, imported modules, and any dynamically processed data.

UI automation is especially sensitive to privilege level. An elevated process can interact with elevated application windows that a standard process may be unable to control because of Windows User Interface Privilege Isolation. Consequently, elevating the interpreter grants the automation substantially broader control than is needed for ordinary desktop applications.

The documentation does not require the user to verify that the target application is elevated, does not explain the security consequences, and does not recommend a narrowly scoped or isolated elevation mechanism. This creates an avoidable path for untrusted or erroneous automation to perform privileged actions.

Attack Path

1. An automation operation fails because of an incorrect selector, loading delay, backend mismatch, or a genuine privilege boundary.
2. The user follows the troubleshooting guidance and launches Python as administrator.
3. Python imports the third-party automation library, transitive ...[truncated 940 chars]

Remediation

View remediation

Remediation Suggestions

1. Make standard-user execution the documented default.
2. Replace generic elevation advice with diagnostics that first verify the window title, selector, UI backend, loading state, and target process integrity level.
3. State explicitly that Python must not be elevated merely because a control cannot be found or a click fails.
4. Require explicit user confirmation before any operation that needs administrator privileges.
5. Explain why elevation is necessary in each supported elevated workflow and document the resulting security exposure.
6. Isolate privileged operations into a minimal, reviewed helper rather than elevating the complete automation interpreter.
7. Restrict the helper to an allowlist of applications and narrowly defined operations.
8. Do not load arbitrary plugins, scripts, configuration, or mutable dependencies in an elevated process.
9. Log elevated actions and verify the target window identity, executable path, process ID, and integrity level before interacting with it.
10. Test normal workflows under a standard account and document elevation only for targets that demonstrably require it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The README explicitly promotes automating message sending and UI input in consumer applications like 微信/QQ without any safety constraints, confirmation steps, scope restrictions, or warnings about acting on the user's live desktop. Because pywinauto operates against arbitrary foreground applications and can click/type into real user sessions, misuse or mistakes can trigger unintended messages, file actions, or data changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill metadata description is broadly phrased as a general-purpose Windows software automation capability, which can cause it to activate for a wide range of ordinary user requests without clear boundaries. Because the skill enables UI control over chat, cloud storage, and other desktop apps, over-broad matching increases the chance of unintended invocation in sensitive contexts and could lead to unauthorized actions in whatever application is currently open.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The headline explicitly promises that the AI can control 'any Windows software' and lists high-risk consumer applications such as WeChat, QQ, and Baidu Netdisk, without meaningful safety restrictions. In context, this is more dangerous than generic automation language because it normalizes arbitrary control of messaging and storage applications, which could be abused for data exfiltration, message sending, destructive actions, or privacy violations if the skill is invoked too broadly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The file’s instructional content is entirely in Chinese, but there is no indication that the skill is intentionally region-specific or that users may choose another language. Per the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.