Orgo Desktop Control

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:05 PM UTC
• Version: 1.0.2

Overview

The skill openly provides Orgo cloud desktop control, including file transfer and remote execution, and the behavior fits its stated purpose.

Install this only if you intend to let an agent operate Orgo cloud desktops with your ORGO_API_KEY. Use a scoped key if available, approve destructive actions and local file uploads explicitly, avoid uploading secrets or broad directories, do not reuse the sample login credentials, handle VNC passwords carefully, and stop or delete remote computers when finished.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/ORGO_ACTION_PATTERNS.md:242
• Finding: Unpinned Third-Party Package Installation from a Mutable Package Index<![CDATA[ ## Vulnerability Details **File Location**: `references/ORGO_ACTION_PATTERNS.md:242-245` **Vulnerability Type**: Unverified and unpinned dependency installation **Risk Level**: Medium ### Vulnerable Code ```python try: result = computer.run_bash("pip install pandas") except OrgoError as exc: # exc message contains the captured stderr/stdout computer.run_bash("pip install --upgrade pip && pip install pandas") ``` ### Technical Analysis The documented recovery workflow installs the latest version of `pandas` and may upgrade `pip` using the environment's default package index. It does not pin exact versions, verify package hashes, use a reviewed lock file, or explicitly restrict downloads to a trusted repository. Because the resolved packages and their transitive dependencies can change after the Skill has been reviewed, the code ultimately executed by this workflow is not reproducible or bounded to audited components. Upgrading `pip` further expands the mutable supply-chain surface. This behavior occurs on the provisioned Orgo cloud computer rather than directly on the local host. Installing dependencies can be necessary for remote computation, but dynamically selecting unaudited versions exceeds the minimum safe behavior needed for the example. ### Attack Path 1. A user or agent follows the documented Bash failure recovery pattern. 2. The remote Orgo computer invokes `pip` against its configured package index. 3. `pip` resolves the latest available `pandas`, installer, and transitive dependency versions. 4. An attacker compromises a package release, dependency, package-index account, configured mirror, or relevant network trust boundary. 5. The compromised component is downloaded and installed without version or hash validation. 6. Malicious installation behavior or subsequently imported package code executes with the privileges of the remote user running `pip`. 7. The malicious code can access data and credentials available inside t ...[truncated 1094 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every directly installed package to an exact, reviewed version, for example: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 2. Maintain a reviewed lock file containing exact versions and cryptographic hashes for all transitive dependencies. 3. Explicitly configure an approved HTTPS package index or an internally controlled package mirror. 4. Do not automatically upgrade `pip` as an error-recovery step. Pin and provision a reviewed installer version as part of the base image instead. 5. Require explicit user authorization before installing new software in a task environment. 6. Run package installation and workloads as an unprivileged user in an isolated, disposable VM. 7. Avoid exposing unrelated credentials, browser sessions, or sensitive files to an environment while installing unaudited dependencies. 8. Apply outbound network restrictions where practical and monitor package-installation activity. 9. Rebuild or discard the remote computer after suspected package compromise rather than reusing its state. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill requires internet access and uses a cloud SDK, but it does not declare any explicit tool scope such as allowed tools or permissions. That omission weakens governance and makes it easier for an agent to invoke network-capable behavior without clear policy boundaries or review, increasing the risk of unintended remote actions and data movement.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

Upload:
```python
client.upload_file("local.txt", ws.id, computer_id=computer.id)
```

Export from VM:

• Confidence: 90% confidence
• Finding: The skill explicitly supports file upload to a remote cloud computer, which creates a direct path for local data to leave the host environment. In a desktop-control skill this may be intended functionality, but without strong consent and path restrictions it can enable unauthorized exfiltration of sensitive local files to remote infrastructure.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The login-flow example embeds a literal username and password in documentation, normalizing insecure credential handling and creating a high risk that users will copy the pattern into real automation. In a remote desktop/browser-control skill, this is especially dangerous because the same code path can be used to access live third-party services, and hardcoded secrets may be committed to source control or leaked in logs/screenshots.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

import urllib.request

# 1. Upload a local file to the workspace
client.upload_file("input.csv", ws.id, computer_id=computer.id)

# 2. Process it on the VM
computer.run_bash("python3 -c \""

• Confidence: 55% confidence
• Finding: Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

import urllib.request

# 1. Upload a local file to the workspace
client.upload_file("input.csv", ws.id, computer_id=computer.id)

# 2. Process it on the VM
computer.run_bash("python3 -c \""

• Confidence: 55% confidence
• Finding: Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

```python
# Start the job in the background, write output to a log
computer.run_bash("nohup python3 train.py > /tmp/train.log 2>&1 &")

# Poll for completion
import time

• Confidence: 65% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: This method executes arbitrary Bash commands on a cloud computer, which is a safety-critical operation. Although the method name and purpose imply execution, there is no explicit warning in the docstring or user-facing disclosure about the risks of running destructive commands or untrusted input.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The method sends arbitrary Python code for execution on the remote computer, which is a safety-critical action. The docstring describes behavior but does not warn that executing untrusted or destructive code can affect the remote system and its data.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The method returns a VNC password, which is a sensitive credential, but the only disclosure is a terse docstring stating what it returns. There is no warning, confirmation, or explicit note that this exposes direct access credentials to the remote computer.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:213