Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill suspicious because scanners report input controls and cancellation weaknesses beyond the described desktop automation, with some files only partly analyzed.
The verdict is suspicious, not malicious. Before installing, consider whether you are comfortable with the reported input-lock capability and the cancellation weaknesses; the scanner's partial coverage means other behavior was not fully assessed.
scripts/browser/overlay.jsUntrusted page scripts can defeat the user's Stop control
A hostile webpage can cause automation to continue after the user requests cancellation, allowing subsequent task actions to proceed against the user's current authorization.
Blocking physical user input is a materially distinct capability from displaying a status overlay or generating automated input, and it is not disclosed in the description. The remaining commands match the declared purpose. The supplied chunk documents this lock behavior but does not include its underlying implementation.
The desktop actions, temporary script staging, and overlay heartbeat handling support the declared purpose. However, requesting suppression of the user's input is materially different from merely displaying an 'agent is working' overlay and is not disclosed in the description. The supplied shell code creates and removes input-lock flags and exposes lock-related options; the actual input-blocking implementation resides in the referenced overlay.ps1, which was not supplied.
Referenced artifact was not completely inspected
`scripts/browser/overlay.js` draws the same glow + status pill with a Stop button inside the page, for browser automation (Playwright, CDP, Puppeteer, OpenClaw
Starting the overlay unconditionally deletes stop.flag before checking whether an overlay is already running. An ordinary or automatic restart therefore clears a user's cancellation request without the explicit resume operation promised by the interface, permitting automation to continue on paths that rely on this flag.
case "$SUB" in
start)
cp "$HERE/windows/overlay.ps1" "$OV_L/../overlay.ps1"
rm -f "$OV_L/stop.flag" "$OV_L/quit.flag"
if [[ -n "${O[lock]:-}" && "${O[lock]}" != 0 ]]; then touch "$OV_L/lock.flag"; else rm -f "$OV_L/lock.flag"; fi
printf '%s' "${O[text]:-${DESKTOP_PILOT_OVERLAY_TEXT:-Agent is working...}}" > "$OV_L/text.txt"
touch "$OV_L/beat"
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
start)
cp "$HERE/windows/overlay.ps1" "$OV_L/../overlay.ps1"
rm -f "$OV_L/stop.flag" "$OV_L/quit.flag"
if [[ -n "${O[lock]:-}" && "${O[lock]}" != 0 ]]; then touch "$OV_L/lock.flag"; else rm -f "$OV_L/lock.flag"; fi
printf '%s' "${O[text]:-${DESKTOP_PILOT_OVERLAY_TEXT:-Agent is working...}}" > "$OV_L/text.txt"
touch "$OV_L/beat"
if overlay_alive; then echo "OK overlay already running (text updated)"; return; fi
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
printf '%s' "${O[text]:-${DESKTOP_PILOT_OVERLAY_TEXT:-Agent is working...}}" > "$OV_L/text.txt"
touch "$OV_L/beat"
if overlay_alive; then echo "OK overlay already running (text updated)"; return; fi
rm -f "$OV_L/pid"
local extra="'-IdleSeconds','${O[idle]:-120}'"; [[ -n "${O[capture]:-}" ]] && extra+=",'-VisibleInCapture'"
[[ -n "${O[lock-idle]:-}" ]] && extra+=",'-LockIdleSeconds','${O[lock-idle]}'"
"$OV_PS" -NoProfile -Command "Start-Process -WindowStyle Hidden powershell -ArgumentList '-NoProfile','-STA','-ExecutionPolicy','Bypass','-File','${OV_WTEMP}desktop-pilot\\overlay.ps1','-Dir','$OV_W',$extra" >/dev/null
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
printf '%s' "${O[text]}" > "$OV_L/text.txt"; touch "$OV_L/beat"; echo "OK overlay text updated" ;;
stop)
if overlay_alive; then touch "$OV_L/quit.flag"; local i; for i in $(seq 1 15); do overlay_alive || break; sleep 0.3; done
overlay_alive && { "$OV_PS" -NoProfile -Command "Stop-Process -Id $(tr -d '\r\n ' < "$OV_L/pid") -Force" >/dev/null; rm -f "$OV_L/pid"; }
echo "OK overlay stopped"
else rm -f "$OV_L/pid"; echo "OK overlay not running"; fi
rm -f "$OV_L/quit.flag" ;;
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
printf '%s' "${O[text]}" > "$OV_L/text.txt"; touch "$OV_L/beat"; echo "OK overlay text updated" ;;
stop)
if overlay_alive; then touch "$OV_L/quit.flag"; local i; for i in $(seq 1 15); do overlay_alive || break; sleep 0.3; done
overlay_alive && { "$OV_PS" -NoProfile -Command "Stop-Process -Id $(tr -d '\r\n ' < "$OV_L/pid") -Force" >/dev/null; rm -f "$OV_L/pid"; }
echo "OK overlay stopped"
else rm -f "$OV_L/pid"; echo "OK overlay not running"; fi
rm -f "$OV_L/quit.flag" ;;
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
if overlay_alive; then touch "$OV_L/quit.flag"; local i; for i in $(seq 1 15); do overlay_alive || break; sleep 0.3; done
overlay_alive && { "$OV_PS" -NoProfile -Command "Stop-Process -Id $(tr -d '\r\n ' < "$OV_L/pid") -Force" >/dev/null; rm -f "$OV_L/pid"; }
echo "OK overlay stopped"
else rm -f "$OV_L/pid"; echo "OK overlay not running"; fi
rm -f "$OV_L/quit.flag" ;;
clear) rm -f "$OV_L/stop.flag"; echo "OK stop flag cleared" ;;
lock)
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
overlay_alive && { "$OV_PS" -NoProfile -Command "Stop-Process -Id $(tr -d '\r\n ' < "$OV_L/pid") -Force" >/dev/null; rm -f "$OV_L/pid"; }
echo "OK overlay stopped"
else rm -f "$OV_L/pid"; echo "OK overlay not running"; fi
rm -f "$OV_L/quit.flag" ;;
clear) rm -f "$OV_L/stop.flag"; echo "OK stop flag cleared" ;;
lock)
overlay_alive || die "overlay is not running (overlay start first)"
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
echo "OK overlay stopped"
else rm -f "$OV_L/pid"; echo "OK overlay not running"; fi
rm -f "$OV_L/quit.flag" ;;
clear) rm -f "$OV_L/stop.flag"; echo "OK stop flag cleared" ;;
lock)
overlay_alive || die "overlay is not running (overlay start first)"
touch "$OV_L/lock.flag" "$OV_L/beat"; echo "OK input lock requested (engages with your next action, releases 8 s after the last one; Esc held 1.5 s or Stop releases it)" ;;
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
lock)
overlay_alive || die "overlay is not running (overlay start first)"
touch "$OV_L/lock.flag" "$OV_L/beat"; echo "OK input lock requested (engages with your next action, releases 8 s after the last one; Esc held 1.5 s or Stop releases it)" ;;
unlock) rm -f "$OV_L/lock.flag"; echo "OK input lock released" ;;
selftest)
cp "$HERE/windows/overlay.ps1" "$OV_L/../overlay.ps1"
"$OV_PS" -NoProfile -STA -ExecutionPolicy Bypass -File "${OV_WTEMP}desktop-pilot\\overlay.ps1" -Dir "$OV_W" -SelfTest | tr -d '\r' ;;
The wrapper calls overlay_hook only in the WSL branch; native Windows proceeds to desktop.ps1 without checking the user's stop flag. Consequently, this wrapper does not enforce the promised cancellation barrier for native Windows, allowing subsequent desktop actions unless the unavailable downstream script independently implements that check.
The manifest describes desktop automation and an informational overlay, but these handlers swallow physical keystrokes and mouse buttons/wheel events while allowing injected input through. Lines L273–L279 activate this behavior when lock.flag exists and the heartbeat is recent; although timeout and emergency-release safeguards exist, blocking the user's input is materially beyond displaying status or issuing automated desktop actions.
The manifest describes showing an "agent is working" overlay, but the lock action creates a lock.flag request explicitly described as suppressing user input. The start action also supports this mode at L060 and describes its input-blocking effect at L069; requesting suppression of human input is materially different from displaying status or generating automated input.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.