ClawHub
Back to skill

Security audit

Desktop Gui

Security checks for vulnerabilities and agentic risk

Overview

This desktop automation skill is coherent, but it recommends sending full desktop screenshots to a hard-coded plaintext HTTP vision endpoint before performing GUI actions.

Review before installing. Use this only in an environment where desktop screenshots and automated clicks are acceptable. Replace the hard-coded HTTP vision endpoint with a user-configured trusted HTTPS or local model, crop or redact screenshots, confirm actions before clicking, delete temporary screenshots, and install dependencies in an isolated pinned environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:145
Finding

Full Desktop Screenshot Transmitted to a Hard-Coded Endpoint over Plaintext HTTP

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:21
Finding

Unpinned Third-Party Dependencies Installed from a Mutable Package Index

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The example code captures the full desktop and transmits it to a remote HTTP API, which constitutes direct exfiltration of potentially sensitive on-screen information. This is especially risky because the stated purpose is desktop automation, not off-host data sharing, and users may run the snippet without understanding that their screen contents leave the machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill demonstrates transmitting screenshots to a vision endpoint without warning that desktop contents may include highly sensitive personal or corporate data. Omitting this privacy notice makes unsafe use more likely and increases the chance of unintentional disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file consistently uses Chinese for the description, headings, warnings, and example prompts, which effectively forces a single language for use of the skill. There is no indication that the skill is region-specific or that users may choose another language, so this creates a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation broadens a local desktop automation skill into a workflow that can send screenshots to a remote vision service. Desktop screenshots routinely contain sensitive data such as emails, credentials, tokens, documents, and chat content, so this scope expansion materially changes the trust boundary and data exposure profile.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

pip3 install pyautogui pygetwindow pymsgbox opencv-python-headless pillow pytesseract

系统工具

sudo apt-get install -y xdotool scrot tesseract-ocr tesseract-ocr-chi-sim tesseract-ocr-chi-tra

text

## 核心功能

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This duplicate finding points to the same behavior: a network request to a remote service as part of screenshot analysis. Because the skill controls the user's real desktop, any outbound transfer of screen contents is particularly dangerous and should be treated as sensitive data exfiltration.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md
用 JSON 格式：{"action": "click", "x": 450, "y": 320, "description": "打卡按钮"}
"""

response = requests.post(
    "http://10.6.207.56:8000/v1/chat/completions",
    headers={"Authorization": "Bearer VLLM_API_KEY"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This duplicate finding points to the same behavior: a network request to a remote service as part of screenshot analysis. Because the skill controls the user's real desktop, any outbound transfer of screen contents is particularly dangerous and should be treated as sensitive data exfiltration.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md
用 JSON 格式：{"action": "click", "x": 450, "y": 320, "description": "打卡按钮"}
"""

response = requests.post(
    "http://10.6.207.56:8000/v1/chat/completions",
    headers={"Authorization": "Bearer VLLM_API_KEY"},
    json={

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
88% confidence
Finding

The example posts data to an internal-network IP address, which introduces additional risk because internal services are often assumed to be more trusted and less monitored. Even though this is not classic attacker-controlled SSRF, documenting direct access to an internal endpoint can facilitate unintended data leakage into a private network service and bypass normal external review controls.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md
用 JSON 格式：{"action": "click", "x": 450, "y": 320, "description": "打卡按钮"}
"""

response = requests.post(
    "http://10.6.207.56:8000/v1/chat/completions",
    headers={"Authorization": "Bearer VLLM_API_KEY"},
    json={