Computer Use Kylinos

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:23 AM UTC
• Version: 1.1.0

Overview

This is a disclosed KylinOS desktop automation skill, with expected risks from screenshots and live keyboard or mouse control.

Install only if you are comfortable letting the agent see and control the active desktop. Avoid using it around passwords, private documents, or account screens; prefer window-only captures, verify the target window before typing or clicking, and replace fixed /tmp screenshot paths with private per-task temporary directories when possible.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:31

Finding

Predictable Shared Temporary Paths Used for Potentially Sensitive Screenshots

Content

View full analysis

--path /tmp/win.png # pick coords from this ``` `SKILL.md:48` ```bash import -window /tmp/win.png # screenshot to pick coords (needs imagemagick) ``` `SKILL.md:123-124` ```bash wlcctrl --windowcapture --path /tmp/w.png wlcctrl --fullscreencapture --path /tmp/f.png [-o ] ``` `SKILL.md:145` ```bash import -window /tmp/w.png # screenshot (imagemagick) ``` `references/details.md:54-57` ```bash wlcctrl --windowcapture --path /tmp/window.png wlcctrl --fullscreencapture --path /tmp/full.png wlcctrl --setarea --path /tmp/area.png wlcctrl --workspacecapture --path /tmp/workspace.png ``` `references/details.md:204-206` ```bash import -window /tmp/window.png # single window (preferred) import /tmp/full.png # whole screen (interactive; needs click) maim /tmp/full.png # whole screen (non-interactive) ``` `references/details.md:253` ```bash xdotool windowactivate and capture with import -window /tmp/w.png. ``` ### Technical Analysis The Skill repeatedly instructs the Agent to store window, workspace, and full-screen captures under fixed, predictable names in the shared `/tmp` directory. It does not create a private temporary directory, generate unique filenames, enforce restrictive permissions, check for pre-existing symbolic links, or remove captures after use. Screenshots may contain confidential application data, notifications, documents, account information, or other desktop content. The effective exploitability depends on the operating system's temporary-file protections, the capture ...[truncated 2075 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs capturing window and full-screen screenshots to /tmp without any warning or guardrails about sensitive data exposure. In a GUI automation skill, screenshots can easily include credentials, personal data, tokens, or unrelated application content, and storing them in predictable temporary paths increases the chance of accidental disclosure to other processes or users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill recommends keyboard text entry as the fastest path but does not warn that keystrokes may go to the wrong focused window or trigger unintended shortcuts/actions. In GUI automation, focus can change unexpectedly, so automated typing can leak secrets into chat windows, terminals, or privileged prompts, or execute destructive commands.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/details.md (reported line 170)May include surrounding context.

Prerequisites

bash

sudo apt install xdotool imagemagick   # imagemagick provides `import` for screenshots
xdotool version
import -version

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/wlcctrl-window-dblclick.sh (reported line 76)May include surrounding context.

sh

echo "# window=($wx,$wy) ${ww}x${wh}, relative=($rx,$ry), logical=($logical_x,$logical_y), scale=$scale, mousemove=($move_x,$move_y)"

# --- Move ONCE, no verification (trust the math) ---
wlcctrl --mousemove "${move_x},${move_y}" 2>&1

# --- Double-click: two presses with minimal delay, NO re-query between ---

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

echo
echo '== xdotool =='
if ! have xdotool; then
  echo 'xdotool: not found — install with: sudo apt install xdotool' >&2
  exit 1
fi
command -v xdotool

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/xdotool-info.sh (reported line 12)May include surrounding context.

sh

echo
echo '== xdotool =='
if ! have xdotool; then
  echo 'xdotool: not found — install with: sudo apt install xdotool' >&2
  exit 1
fi
command -v xdotool

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/xdotool-info.sh (reported line 31)May include surrounding context.

sh

echo
echo '== xdotool =='
if ! have xdotool; then
  echo 'xdotool: not found — install with: sudo apt install xdotool' >&2
  exit 1
fi
command -v xdotool

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file documents commands that capture window, workspace, and full-screen screenshots and later inject keyboard/mouse input, but it does not include any explicit warning that these actions may expose sensitive on-screen data or affect the active desktop session. Under the markdown-file criteria for SQP-2, descriptions of behaviors that can affect user privacy or system integrity should disclose those risks.

Content

No source excerpt is available for this finding.