Control

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:22 AM UTC
• Version: 1.0.0

Overview

The skill is a real desktop automation tool, but it can control the live desktop, read screenshots and clipboard data, and launch commands with incomplete approval safeguards.

Install only if you intentionally want an agent or script to control your live desktop. Use it in a non-sensitive profile or VM first, keep failsafe enabled, avoid administrator mode, do not use it while secrets or private documents are visible or copied, and treat screenshot and clipboard features as sensitive data access.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: __init__.py:130

Finding

Approval Mode Does Not Cover All Sensitive Desktop Operations

Content

View full analysis

Vulnerability Details

File Location: __init__.py:130-141, __init__.py:198-228, and __init__.py:364-380
Vulnerability Type: Incomplete authorization enforcement
Risk Level: High

Vulnerable Code

python

def scroll(self, clicks: int, direction: str = 'vertical',
           x: Optional[int] = None, y: Optional[int] = None) -> None:
    if x is not None and y is not None:
        pyautogui.moveTo(x, y)

    if direction == 'vertical':
        pyautogui.scroll(clicks)
    else:
        pyautogui.hscroll(clicks)
    logger.debug(f"Scrolled {direction} {clicks} clicks")

python

def key_down(self, key: str) -> None:
    """Press and hold a key without releasing."""
    pyautogui.keyDown(key)
    logger.debug(f"Key down: '{key}'")

def key_up(self, key: str) -> None:
    """Release a held key."""
    pyautogui.keyUp(key)
    logger.debug(f"Key up: '{key}'")

python

def screenshot(self, region: Optional[Tuple[int, int, int, int]] = None,
               filename: Optional[str] = None):
    """
    Capture screen or region.
    """
    img = pyautogui.screenshot(region=region)

    if filename:
        img.save(filename)
        logger.info(f"Screenshot saved to: {filename}")
    else:
        logger.debug(f"Screenshot captured (region={region})")
        return img

python

def get_from_clipboard(self) -> Optional[str]:
    """
    Get text from clipboard.
    """
    try:
        import pyperclip
        text = pyperclip.paste()
        logger.debug(f"Got from clipboard: '{text[:50]}...'")
        return text
    except ImportError:
        logger.error("pyperclip not installed. Run: pip install pyperclip")
        return None
    except Exception as e:
        logger.error(f"Error getting clipboard: {e}")
        return None

Technical Analysis

DesktopController exposes a require_approval option t ...[truncated 1766 chars]

Remediation

View remediation

Remediation Suggestions

• Apply _check_approval() to every sensitive read and state-changing operation, including screenshots, clipboard reads and writes, scrolling, key_down, key_up, pixel inspection, window enumeration, and window activation.
• Distinguish approval categories such as input control, screen capture, clipboard access, and window inspection so users can grant narrowly scoped permissions.
• Default to denial when approval cannot be obtained.
• Ensure held keys are released in finally blocks to prevent modifier keys from remaining active after an error.
• Add automated tests that instantiate the controller with require_approval=True and verify that every sensitive public method invokes the approval mechanism.
• Document precisely which operations are covered instead of presenting approval mode as universal until enforcement is complete.

T09 · Insecure Skill Coding Practices

Warning

• Location: __init__.py:154

Finding

Sensitive Typed and Clipboard Content Is Exposed Through Logs and Console Output

Content

View full analysis

Vulnerability Details

File Location: __init__.py:154-169, __init__.py:348-374, and demo.py:164-175
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: Medium

Vulnerable Code

python

def type_text(self, text: str, interval: float = 0, wpm: Optional[int] = None) -> None:
    """
    Type text with configurable speed.
    """
    if wpm is not None:
        chars_per_second = (wpm * 5) / 60
        interval = 1.0 / chars_per_second

    if self._check_approval(f"type text: '{text[:50]}...'"):
        pyautogui.write(text, interval=interval)
        logger.info(
            f"Typed text: '{text[:50]}{'...' if len(text) > 50 else ''}' "
            f"(interval={interval:.3f}s)"
        )

python

def copy_to_clipboard(self, text: str) -> None:
    """
    Copy text to clipboard.
    """
    try:
        import pyperclip
        pyperclip.copy(text)
        logger.info(f"Copied to clipboard: '{text[:50]}...'")
    except ImportError:
        logger.error("pyperclip not installed. Run: pip install pyperclip")
    except Exception as e:
        logger.error(f"Error copying to clipboard: {e}")

def get_from_clipboard(self) -> Optional[str]:
    """
    Get text from clipboard.
    """
    try:
        import pyperclip
        text = pyperclip.paste()
        logger.debug(f"Got from clipboard: '{text[:50]}...'")
        return text
    except ImportError:
        logger.error("pyperclip not installed. Run: pip install pyperclip")
        return None
    except Exception as e:
        logger.error(f"Error getting clipboard: {e}")
        return None

python

original = dc.get_from_clipboard()
print(f"\n1. Original clipboard: '{original}'")

test_text = "Hello from OpenClaw Desktop Control!"
dc.copy_to_clipboard(test_text)
print(f"2. Copied to clipboard: '{test_text}'")

new_clipboard = dc.get_from_clipboard()

...[truncated 1962 chars]

Remediation

View remediation

Remediation Suggestions

• Remove text and clipboard values from all default log messages.
• Log only non-sensitive metadata, such as action type, character count, and success or failure.
• Change approval prompts to neutral wording such as Allow typing 24 characters?.
• Never print existing clipboard content in demonstrations. Display only whether clipboard access succeeded.
• If content logging is needed for debugging, require an explicit opt-in flag and prominently warn that it is unsafe for secrets.
• Add a centralized redaction utility and tests covering passwords, tokens, email addresses, and multiline clipboard data.
• Avoid calling logging.basicConfig() from a reusable package; allow the host application to configure log levels and handlers.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:52

Finding

Dependencies Are Installed Without Version or Integrity Pinning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:52-57, SKILL.md:614-619, and QUICK_REFERENCE.md:247-251
Vulnerability Type: Uncontrolled third-party dependency resolution
Risk Level: Medium

Vulnerable Code

bash

pip install pyautogui pillow opencv-python pygetwindow

bash

pip install pyautogui pillow opencv-python pygetwindow pyperclip

Technical Analysis

The installation instructions resolve mutable latest versions from the configured Python package index. They do not specify reviewed versions, lock transitive dependencies, or verify distribution hashes.

This does not prove that any named package is currently malicious. However, it makes the installed code differ over time from the code that was reviewed. A compromised package release, compromised package-index account, malicious package source configured in the environment, or unexpected incompatible update would execute during installation or import with the user's privileges.

The dependency set is particularly sensitive because it receives direct access to keyboard input, mouse control, screen capture, window metadata, and clipboard contents.

Attack Path

1. A user follows the documented unpinned pip install command.
2. Pip resolves whatever versions are current on the configured index at installation time.
3. A dependency, transitive dependency, or configured package source supplies a compromised release.
4. Malicious installation or import-time code executes with the privileges of the Python process.
5. The compromised component gains the same desktop and data access expected by the automation package.

Impact Assessment

A successful supply-chain compromise could execute arbitrary code with the installing user's privileges. If the user follows the separate recommendation to run Python as an administrator, the resulting impact could extend to administrative control of the host. Potentially exposed resources ...[truncated 104 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to a reviewed version.
• Use a lock file that records all transitive versions.
• Generate and enforce cryptographic hashes, for example with pip-compile --generate-hashes and pip install --require-hashes.
• Document the expected trusted package index and reject unexpected extra indexes.
• Install dependencies in a dedicated virtual environment under a non-administrative account.
• Add automated vulnerability and provenance checks for direct and transitive dependencies.
• Review new dependency releases before updating the lock file.
• Ensure documentation consistently includes pyperclip if clipboard functionality remains supported.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:602

Finding

Documentation Encourages Running the Entire Automation Process With Administrator Privileges

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:602-605
Vulnerability Type: Excessive privilege recommendation
Risk Level: Medium

Vulnerable Code

text

### Permission errors
- Run Python with administrator privileges for some operations
- Some secure applications block automation

Technical Analysis

The documentation recommends administrator execution as a generic response to permission errors without identifying a specific operation that legitimately requires elevation. The project controls keyboard and mouse input, accesses the clipboard and screen, launches commands through the Windows Run dialog, and loads multiple third-party dependencies.

Elevating the entire Python interpreter violates least-privilege principles and expands the impact of dependency compromise, command injection, programming errors, and unintended automation. Elevation also does not guarantee that applications using protected desktops or anti-automation controls will accept simulated input.

Attack Path

1. A user encounters a permission or automation error.
2. The user follows the troubleshooting instruction and starts Python as an administrator.
3. The desktop controller, AI agent, imported dependencies, and caller code all inherit elevated privileges.
4. A malicious dependency, unsafe caller, or injected application-launch value triggers unintended execution.
5. The unintended code executes with administrator privileges instead of ordinary user privileges.

Impact Assessment

This recommendation can transform a user-level compromise into an administrator-level compromise. Depending on operating-system controls, elevated code may modify protected files and settings, access other users' data, install software, alter security configuration, or establish persistence. The project itself does not contain a persistence mechanism, but elevation increases the consequences of other vulnerabilities.

Remediation

View remediation

Remediation Suggestions

• Remove the blanket recommendation to run Python as an administrator.
• Document the specific operations and operating-system conditions that may require additional rights.
• Keep the main automation process unprivileged.
• If a narrowly defined operation truly requires elevation, place it in a minimal helper with strict input validation and explicit per-operation consent.
• Warn users that elevation increases the impact of dependencies and automation mistakes.
• Diagnose permission failures explicitly rather than using elevation as a generic workaround.
• Add a runtime warning or refusal when the package detects unnecessary administrative execution.

T09 · Insecure Skill Coding Practices

Error

• Location: ai_agent.py:302

Finding

Caller-Controlled Application Values Can Be Executed Through the Windows Run Dialog

Content

View full analysis

Vulnerability Details

File Location: ai_agent.py:302-312 and ai_agent.py:369-382
Vulnerability Type: Command injection through GUI command execution
Risk Level: High

Vulnerable Code

python

def _execute_step(self, step: Dict[str, Any]) -> Dict[str, Any]:
    """
    Execute a single step.
    """
    step_type = step.get("type")
    result = {"step": step, "success": False}

    try:
        if step_type == "launch_app":
            self._do_launch_app(step["app"])
            result["success"] = True

python

def _do_launch_app(self, app: str) -> None:
    """Launch an application."""
    # Get launch command from knowledge base
    app_info = self.app_knowledge.get(app, {})
    launch_cmd = app_info.get("launch_command", app)

    # Open Run dialog
    self.dc.hotkey('win', 'r')
    time.sleep(0.5)

    # Type and execute command
    self.dc.type_text(launch_cmd, wpm=100)
    self.dc.press('enter')

    logger.info(f"Launched: {app}")

The guide also documents direct use of the step executor:

python

# Manual mode: Execute individual steps
step = {"type": "launch_app", "app": "paint"}
result = agent._execute_step(step)

Technical Analysis

_do_launch_app() looks up a fixed command for known application identifiers. If the identifier is not present, however, the unvalidated app value becomes the command:

python

launch_cmd = app_info.get("launch_command", app)

The value is then typed into the Windows Run dialog and submitted. The Run dialog accepts executable names, paths, document handlers, and command-interpreter invocations. Consequently, a caller capable of constructing a step dictionary can execute a command rather than merely select an approved application.

The current natural-language planner generally returns known application identifiers and defaults unknown launch requests to Notepad. That reduces exposure ...[truncated 1324 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the fallback behavior with a strict allowlist:

  python

  if app not in self.app_knowledge:
      raise ValueError("Unsupported application")
  launch_cmd = self.app_knowledge[app]["launch_command"]
  

• Do not use the Windows Run dialog as a generic command-execution mechanism.
• Store fixed executable paths for approved applications and launch them through an API that does not invoke a command interpreter.
• Separate application identifiers from executable commands and never permit a planner to provide raw command strings.
• Validate step schemas before execution and reject unknown step types, fields, applications, and malformed values.
• Require explicit approval that shows the resolved executable before launching an application.
• Treat all future LLM-generated plans as untrusted input and enforce the allowlist after planning but before execution.
• Restrict or remove the documented direct _execute_step() interface, since its underscore prefix does not constitute a security boundary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation advertises autonomous form filling, file operations, social posting, and cross-application data movement without warning about the risk of modifying local data, disclosing private information, or taking actions on third-party accounts. In a desktop agent with keyboard/mouse control, these capabilities can directly cause irreversible external effects such as submissions, posts, uploads, deletions, or sensitive data transfer.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description is narrower than the documented capabilities. In addition to generic desktop control, the skill explicitly supports window enumeration/activation, clipboard read/write, screenshots, and approval prompts, which materially expand its ability to access sensitive user context and manipulate other applications. This mismatch can cause downstream systems or users to underestimate the skill’s access and trust boundary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide presents very broad natural-language commands such as drawing, typing, and app control without clearly constraining what requests are in scope or what confirmation is required before action. In a desktop automation skill, ambiguous activation scope increases the chance the agent will execute unintended actions from loosely phrased prompts, surrounding conversation, or misinterpreted user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill describes observing the screen, using screenshots, OCR, and object detection, but does not warn that sensitive on-screen data may be captured, stored, or processed. Because desktop screens often contain emails, documents, credentials, or personal data, silent screen capture materially increases privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide normalizes disabling the failsafe and labels it as a fast mode without explaining that this removes a safety control that may help stop runaway mouse/keyboard automation. If users disable failsafe in an autonomous desktop agent, accidental loops or misdirected actions can become much harder to interrupt and may lead to broader system or account impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation advertises screenshot capture, region capture, pixel inspection, and saving screenshots to disk without a clear privacy or data-handling warning. In a desktop automation skill, screenshots can easily capture sensitive information such as credentials, messages, customer data, or confidential documents, and saving them to files increases persistence and exposure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The quick reference includes automation examples that can modify data, submit forms, copy files, trigger hotkeys, and switch windows, but it does not place a clear warning near those examples that these actions can cause unintended system changes if run in the wrong context. In a desktop-control skill, this is particularly risky because actions are executed against the live user environment, so a mistaken target window or coordinate can lead to accidental data modification, disclosure, or destructive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The screen and clipboard features enable access to privacy-sensitive data such as passwords, tokens, personal messages, and confidential documents visible on screen or stored in the clipboard. The documentation presents these capabilities as normal features without a prominent warning about sensitive-data exposure, which increases the chance they will be used in unsafe contexts or with insufficient user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The examples encourage saving screenshots directly to disk, which can persist sensitive on-screen information beyond the immediate session. Without a warning about file persistence, storage location, retention, or access controls, users may unintentionally create recoverable image artifacts containing confidential data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The screenshot helper can capture the screen and optionally save it to disk with no approval or disclosure in the default quick-access path. Screenshots may include credentials, private conversations, tokens, or other sensitive visual data, and saving them to disk increases persistence and exfiltration risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Window enumeration and activation allow the agent to inspect the user's active applications and shift focus to arbitrary windows, which can expose sensitive context and facilitate unintended interaction with security-critical apps. These capabilities are broader than the stated description and create a stronger attack surface for UI redressing, data exposure, or misdirected input.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill exposes clipboard read and write functions that can access or overwrite sensitive user data such as passwords, tokens, private messages, or copied documents. This exceeds the narrowly stated desktop-control purpose and, because these functions do not require approval by default, an agent could silently harvest or tamper with clipboard contents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Clipboard writes silently modify user state and can replace expected clipboard contents with attacker-controlled text, commands, links, or wallet addresses. Even without direct exfiltration, this can enable phishing, command injection into subsequent paste actions, or user confusion in sensitive workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Clipboard reads can silently access highly sensitive transient data, including passwords, API keys, personal information, or financial addresses that users recently copied. In an automation skill with broad desktop control, this becomes more dangerous because the same component could pair collection with screenshots, window switching, or automated exfiltration steps.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The agent automatically captures screenshots before and after each step and stores them in the returned result structure without any explicit consent, minimization, or warning to the user. Because screenshots can contain credentials, private messages, documents, or other sensitive desktop content, this creates a real privacy and data-handling risk in a desktop automation skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code writes screenshots to disk using a caller-controlled filename without providing a clear warning that potentially sensitive screen contents will be saved locally. Persisting screenshots increases exposure because local files may be recovered later, synced to cloud storage, or accessed by other users or processes on the system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill can open applications via the Run dialog and inject keystrokes into the desktop, enabling autonomous control of the user's system with very limited safeguards. In the context of a desktop automation agent, this is especially dangerous because natural-language tasks could trigger unintended or abusive actions such as launching tools, entering commands, or interacting with sensitive applications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.