ClawHub
Back to skill

Security audit

pipx-desktop-agent

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate desktop automation skill, but it needs review because it gives broad desktop control and contains exploitable command/script injection paths.

Install only in a trusted, non-sensitive desktop session and pin the package version. Do not let untrusted prompts, webpages, or documents choose app names, app arguments, hotkeys, or OCR targets. Avoid running it with administrator privileges, and treat screenshots/OCR output as sensitive because it can include anything visible on screen.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/install.py:41
Finding

Remote Installer Downloaded and Executed Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
desktop_agent/commands/app.py:52
Finding

Windows Command Injection Through Application Name and Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
desktop_agent/commands/app.py:128
Finding

AppleScript Injection Through Unescaped Application Name

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
desktop_agent/commands/screen.py:224
Finding

Predictable OCR Screenshot File Enables Data Exposure and File Clobbering

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (259)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · AGENTS.md (reported line 1)May include surrounding context.

md
<!-- OPENSPEC:START -->
# OpenSpec Instructions

These instructions are for AI assistants working in this project.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared description emphasizes mouse, keyboard, and screen automation, but the documented behavior also includes application launching, window enumeration, and focus/activation through OS-level mechanisms. This capability expansion matters because reviewers and policy systems may approve the skill for limited UI automation while overlooking broader host interaction and process-control behaviors.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description emphasizes mouse, keyboard, and screen automation, but the documented behavior also includes application launching, window enumeration, and focus/activation through OS-level mechanisms. This capability expansion matters because reviewers and policy systems may approve the skill for limited UI automation while overlooking broader host interaction and process-control behaviors.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

This duplicate finding points to the same unsafe sink: Popen(..., shell=True) with attacker-controlled name. The desktop-control context makes it more dangerous because the skill is explicitly designed to accept action requests that may be generated indirectly, enabling prompt-to-command abuse.

Content

Scanner excerpt · desktop_agent/commands/app.py (reported line 68)May include surrounding context.

python
shell=True,
                )
            else:
                subprocess.Popen(f'start "" "{name}"', shell=True)

        elif current_platform == "macos":
            cmd = ["open", "-a", name]

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

This duplicate finding points to the same unsafe sink: Popen(..., shell=True) with attacker-controlled name. The desktop-control context makes it more dangerous because the skill is explicitly designed to accept action requests that may be generated indirectly, enabling prompt-to-command abuse.

Content

Scanner excerpt · desktop_agent/commands/app.py (reported line 68)May include surrounding context.

python
shell=True,
                )
            else:
                subprocess.Popen(f'start "" "{name}"', shell=True)

        elif current_platform == "macos":
            cmd = ["open", "-a", name]

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The hotkey command can invoke powerful global shortcuts such as save, close, paste, quit, undo, terminal interrupts, or OS-level actions without any user acknowledgment. In the context of a desktop automation skill, unrestricted hotkeys are especially dangerous because a single shortcut can trigger destructive or irreversible behavior in the focused application or operating system.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · openspec/changes/rename-to-desktop-agent/proposal.md (reported line 34)May include surrounding context.

md
- [ ] Update any hardcoded references to "desktop-skill"

## Phase 3: Documentation
- [ ] Update SKILL.md with new command invocations (`uvx desktop-agent`)
- [ ] Update README.md with uvx installation instructions
- [ ] Update examples/automation_examples.md with new command format
- [ ] Add migration notes for existing users

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · openspec/changes/rename-to-desktop-agent/tasks.md (reported line 16)May include surrounding context.

md
- [ ] Update any hardcoded references to "desktop-skill"

## Phase 3: Documentation
- [ ] Update SKILL.md with new command invocations (`uvx desktop-agent`)
- [ ] Update README.md with uvx installation instructions
- [ ] Update examples/automation_examples.md with new command format
- [ ] Add migration notes for existing users

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The activation guidance uses broad conditions such as requests that 'mention planning or proposals' and anything that 'sounds ambiguous,' which can overlap with common project conversations. The file does not provide clear boundaries, explicit exclusions, or negative examples to distinguish when the instructions should not be applied.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

The README instructs users/agents to install and execute a package via npx skills add without pinning a specific version or immutable source. This creates a supply-chain risk where a later compromised or malicious release could be fetched automatically, which is more concerning in an agent skill because agents may follow installation instructions non-interactively.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
79% confidence
Finding

The uvx desktop-agent --help example references an unpinned package execution path, meaning the resolved package version may change over time. For a desktop-control tool with input injection and screen access, fetching an unexpected version materially increases risk because a malicious update could immediately gain powerful local automation capabilities.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
79% confidence
Finding

This is another unpinned uvx desktop-agent invocation, which exposes users and agents to the latest published package rather than a reviewed version. Because this skill can control keyboard, mouse, apps, and screen data, accidental execution of a compromised release could have immediate local impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README includes keyboard injection, hotkeys, app launching, and automation examples without warning that these commands can drive other applications, trigger destructive actions, or modify user data. In the context of an AI agent skill for desktop control, lack of safety guidance materially increases the chance of misuse, accidental command execution in the wrong window, or stealthy abuse for credential theft or unauthorized actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README promotes screenshots, OCR, and text extraction without warning that these operations may capture secrets such as passwords, tokens, private messages, or sensitive documents visible on screen. In a desktop automation skill, this omission is significant because users or agents may treat the commands as routine utilities without appreciating their data-exfiltration potential.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README documents application-launching and focusing features beyond the stated metadata scope of mouse, keyboard, and screen control. This scope mismatch can mislead reviewers and agent frameworks about the real capability set, reducing informed consent and making abuse of broader desktop control easier to hide.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill invokes shell-based desktop automation (uvx desktop-agent) but does not declare any permissions or allowed-tools scope. This weakens containment and review, because a consuming agent may treat the skill as documentation while it actually requires broad shell execution to control the desktop, launch apps, and inspect windows.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The skill repeatedly references uvx desktop-agent without pinning a specific version or immutable source. An attacker controlling upstream releases, dependency resolution, or a compromised package version could change behavior and gain arbitrary desktop-control or code-execution capability under the agent's context.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The skill repeatedly references uvx desktop-agent without pinning a specific version or immutable source. An attacker controlling upstream releases, dependency resolution, or a compromised package version could change behavior and gain arbitrary desktop-control or code-execution capability under the agent's context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The keyboard automation section lacks a strong warning that typed input and hotkeys may go to the wrong application, execute privileged shortcuts, submit forms, or trigger destructive actions. Because this skill operates on the live desktop, a focus mistake can cause data loss, command execution, or accidental disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documents screenshot and OCR features without a clear privacy warning that they can capture secrets such as passwords, emails, internal documents, tokens, or unrelated application content visible on screen. In an agent setting, that omission increases the chance of over-collection and exfiltration of sensitive user data.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 447)May include surrounding context.

uvx desktop-agent app focus "Notepad" uvx desktop-agent keyboard write "Hello World" # Step 4: Now safe to type

❌ WRONG: Type immediately without verification

uvx desktop-agent app open notepad uvx desktop-agent keyboard write "Hello World" # May type in wrong window!

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The screenshot command captures the user's screen contents and saves the image to disk, which can include sensitive on-screen data. Although the command prints where the file was saved, there is no warning, confirmation, or explanatory comment/docstring disclosing the privacy-sensitive nature of capturing screen contents.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
99% confidence
Finding

This Windows code builds a shell command from untrusted inputs (name and joined args_list) and executes it with shell=True. An attacker can inject shell metacharacters or crafted arguments to execute arbitrary commands on the host, which is especially dangerous in a desktop-control skill that is expected to receive external task parameters.

Content

Scanner excerpt · desktop_agent/commands/app.py (reported line 63)May include surrounding context.

python
if current_platform == "windows":
            if args_list:
                subprocess.Popen(
                    f'start "" "{name}" {" ".join(args_list)}',
                    shell=True,
                )

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill can launch applications on Windows via shell execution without any user-facing warning, confirmation, or policy restriction. In the context of a desktop-control agent, this increases the chance that an upstream prompt, tool caller, or compromised workflow can silently start unsafe programs or chained commands.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
99% confidence
Finding

This is also shell execution on Windows with untrusted name interpolated into the command string. Even without extra args, a crafted application name can break quoting or append additional shell syntax, resulting in arbitrary command execution.

Content

Scanner excerpt · desktop_agent/commands/app.py (reported line 68)May include surrounding context.

python
shell=True,
                )
            else:
                subprocess.Popen(f'start "" "{name}"', shell=True)

        elif current_platform == "macos":
            cmd = ["open", "-a", name]