desktop-operator

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:05 AM UTC
• Version: 1.0.0

Overview

The skill broadly matches its desktop automation purpose, but it captures the whole desktop, saves screenshots in the user's home folder, and can force-close matching apps without clear warning.

Review this carefully before installing. Use it only with apps and data you are comfortable automating and capturing, because it can take a whole-desktop screenshot, leave that image on disk, enable local debugging for the app, and forcibly close processes with matching names.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the implementation actually takes full desktop screenshots, writes files under a user directory, and uses pkill, that materially exceeds the declared purpose of targeted Electron automation via Puppeteer. In this skill context, undeclared OS-level capture and process termination are especially dangerous because they can expose unrelated on-screen data and disrupt local applications beyond the user's expected action.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If the implementation actually takes full desktop screenshots, writes files under a user directory, and uses pkill, that materially exceeds the declared purpose of targeted Electron automation via Puppeteer. In this skill context, undeclared OS-level capture and process termination are especially dangerous because they can expose unrelated on-screen data and disrupt local applications beyond the user's expected action.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

node dist/index.js --app "{appName}" --target "{targetText}"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

node dist/index.js --app "{appName}" --target "{targetText}"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README explicitly promotes automated control of Electron apps, DOM interaction, and screenshot capture, but it does not warn about the privacy and system-impact risks of driving desktop applications or capturing potentially sensitive on-screen data. In this context, the skill targets local desktop apps via remote debugging, which increases risk because it can expose account data, internal business information, or perform unintended actions if used carelessly or repurposed.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises local desktop automation and screenshot capture but does not declare any explicit tool scope or permissions boundaries. For a skill that can interact with local applications and access the desktop, missing scope declarations weakens reviewability and increases the chance of overbroad execution or unintended access to environment-provided capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description and examples do not clearly warn users that the skill will control local desktop applications and capture screenshots. In this context, missing disclosure is risky because screenshots may include sensitive information from the app or broader desktop environment, and users may not realize they are granting local GUI automation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases are broad enough that ordinary user requests about opening an app or viewing a page could invoke local desktop control without clear consent boundaries. In a skill that can click UI elements and capture screenshots, ambiguous activation increases the risk of unintended interaction with sensitive local applications or data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code captures the entire user screen and writes the image to disk under the user's home directory without any user-facing warning, confirmation, or minimization. This can persist sensitive information such as messages, credentials, documents, or other application contents beyond the intended automation target.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes operating an Electron app and taking a screenshot, but the implementation performs a full desktop screenshot via /usr/sbin/screencapture rather than an app-scoped capture. That can collect unrelated windows, notifications, secrets, or other apps' contents, making the behavior substantially broader and more privacy-invasive than stated.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill invokes a host-level shell command to capture the screen using execSync, which exceeds pure in-app DOM automation and introduces unnecessary OS command execution. Even if the command string is not directly user-controlled here, shelling out broadens the attack surface and gives the skill capabilities beyond the narrowly described Electron UI interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill launches an application with remote debugging enabled and later forcibly terminates it, all without explicit user warning or confirmation. This can surprise users, disrupt active work, and expose a debuggable surface on the local machine during execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill forcibly terminates processes using pkill -f on the app name, which is outside the stated scope of opening an app, clicking a UI element, and taking a screenshot. Pattern-based process killing can also terminate unintended processes with matching names, causing availability and data-loss risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README presents all operational instructions in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate a language/locale policy when the skill forces a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Many error and status messages are hard-coded in Chinese, while the file provides no option for user language selection and no justification that the skill is intended only for a Chinese-speaking locale. This creates a natural-language policy issue because the skill imposes a specific language without opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency uses a caret range, which allows newer minor/patch releases of Puppeteer to be installed without review. In a desktop automation skill that drives Electron applications, unexpected dependency changes can introduce vulnerable code or breaking behavior into a privileged automation component.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json

"cdp"
  ],
  "dependencies": {
    "puppeteer": "^22.0.0",
    "puppeteer-core": "^22.15.0"
  },
  "license": "MIT"

Unverifiable Dependency: puppeteer has 1 known advisory(ies) (CVE-2019-5786 (Use-After-Free in puppeteer)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency uses a caret range, so installs are not fully reproducible and may silently pull in different puppeteer-core releases over time. Because this skill automates local Electron desktop apps via CDP, supply-chain or regression issues in a transitive update could affect a component with significant local control.

Content

Scanner excerpt · package.json (reported line 23)May include surrounding context.

json

],
  "dependencies": {
    "puppeteer": "^22.0.0",
    "puppeteer-core": "^22.15.0"
  },
  "license": "MIT"
}

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: dist/index.js:110