Security audit

Desktop Agent Ops

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed desktop-automation tool, but its automatic setup and Windows clipboard implementation create enough system-impact risk to require review before installation.

Install only if you are comfortable granting desktop screen-capture and input-control privileges. Prefer reviewing or fixing the Windows clipboard command path, pinning dependencies and OCR assets, and requiring explicit user approval before setup installs packages, opens permission settings, or runs diagnostic screenshots and mouse movement.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/first_run_setup.py:635
Finding: Remote Installer Piped Directly into a Shell
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/desktop_ops.py:609
Finding: PowerShell Command Injection Through Clipboard Text
Content: View full analysis
" ``` 3. `cmd_type()` calls `paste_text()`. 4. On Windows, `paste_text()` interpolates the crafted text into a PowerShell `Set-Clipboard` command. 5. PowerShell parses and evaluates embedded subexpressions or other app ...[truncated 755 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/first_run_setup.py:324
Finding: Unpinned Dependencies and Unverified Mutable OCR Assets
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (78)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The declared description presents a desktop task skill, but the body also performs bootstrap/setup actions including package installation, permission-state persistence, and opening OS privacy/settings dialogs. That mismatch can mislead users or orchestrators about the real trust boundary, causing unanticipated system modification and privacy-sensitive permission changes.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 262)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 263)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 266)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 271)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 275)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.
md
$PY scripts/desktop_ops.py type --text "your message"

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: These checks actively invoke desktop automation actions including screenshot capture and mouse movement during a diagnostic run, without any explicit runtime confirmation or safety gating in this file. In the context of a desktop-control skill, such behavior is especially dangerous because it can capture sensitive on-screen data and interfere with the user's active session merely by running a health check.
Content: No source excerpt is available for this finding.

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · scripts/first_run_setup.py (reported line 429)May include surrounding context.
python
cmd.append("--open-settings") # Pass the venv python via env so sub-scripts use it env = os.environ.copy() env["DESKTOP_AGENT_OPS_PYTHON"] = python_exec try: p = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env)

Static analysis

No suspicious patterns detected.