Security audit

Cua Driver

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent desktop automation, but it deserves Review because it grants high-impact screen/control authority and includes risky install and bypass modes that are not strongly user-gated.

Install only if you trust the cua-driver publisher and need real desktop automation. Prefer verified installers over piping remote scripts directly into a shell, keep browser work in isolated profiles unless you explicitly need an existing login, avoid embedded unrestricted mode unless the host app provides clear consent and logging, and treat recordings as sensitive because they may capture the full screen and typed actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document explicitly instructs integrators how to launch the driver in `unrestricted` mode, which disables runtime approvals for sensitive GUI actions, while only warning implementers to 'accept the consequences' and not requiring explicit end-user consent or UX safeguards. In the context of a computer-use driver with Accessibility and Screen Recording privileges, this materially increases the risk of silent prompt-injection-driven or unintended actions against the host desktop.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document explicitly describes background click/keystroke injection and session recording, including no-foreground operation that avoids visibly activating the target window. Even if this is legitimate functionality for GUI automation, documenting and enabling covert input/recording without clear user-consent, visibility, and privacy warnings increases the risk of misuse for stealthy interaction with applications and capture of sensitive on-screen data.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The feature enables full-display video capture by default and records all action inputs, screenshots, and UI state into persistent artifacts, which can easily include sensitive information such as credentials, personal data, or proprietary content. Although recording requires explicit user invocation, the documentation lacks a strong privacy warning, consent guidance, or safer defaults, making accidental over-collection and retention plausible in normal use.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The manifest description is extremely broad ('when the user asks you to operate, drive, automate, or perform a GUI task in a real application on the host'), which can cause the skill to activate for many high-risk host interactions without narrowing scope or warning about side effects. In a skill that can launch apps, click/type into native windows, and escalate to desktop/foreground input, over-broad activation materially increases the chance of inappropriate invocation and unintended real-world actions.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill states that recording can create video capture by default, but this behavior is not surfaced as a clear warning in the skill description or activation context. Because recordings may capture sensitive on-screen data from the host environment, insufficient upfront warning creates privacy and data-exposure risk, especially in a host-automation skill.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The document instructs users to run `irm https://cua.ai/driver/install.ps1 | iex`, which downloads and immediately executes a remote PowerShell script. This is dangerous because it bypasses review of the installer contents and turns any compromise of the hosting domain, transport path, or script publisher into arbitrary code execution on the host.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.