my skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:29 AM UTC
• Version: 1.0.0

Overview

The skill appears to be legitimate desktop automation documentation, but it grants broad desktop-control authority through an unpinned external CLI install and lacks clear safety guardrails for sensitive UI, clipboard, screenshot, and notification access.

Review this carefully before installing. Use it only in a trusted desktop session, prefer a pinned and verified CLI version, avoid the Bun trusted install path unless you have audited it, and revoke macOS Accessibility permission when finished. Do not allow agents to read screenshots, clipboard contents, notifications, or sensitive app windows unless the user has explicitly approved that action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Unpinned Global Package Installation with Trusted Lifecycle Scripts

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:27-30
Vulnerability Type: Unpinned third-party dependency and trusted package lifecycle scripts
Risk Level: Medium

Vulnerable Code

bash

npm install -g agent-desktop
# or
bun install -g --trust agent-desktop

Technical Analysis

The installation instructions retrieve agent-desktop without specifying an exact version or integrity hash. Consequently, the installed implementation can change independently of the reviewed Skill version.

Both alternatives install the package globally, increasing the scope of any compromised package code. The Bun alternative explicitly uses --trust, allowing package lifecycle scripts to run during installation. The artifact contains only documentation and metadata; it does not include the executable agent-desktop implementation or dependency lock data. Therefore, the downloaded package and its transitive dependencies cannot be verified against the reviewed documentation.

This is a supply-chain weakness rather than evidence that the current package is malicious.

Attack Path

1. An attacker compromises the agent-desktop package, its publisher account, or a transitive dependency.
2. The attacker publishes a malicious release under the same package name.
3. A user follows the documented unpinned global installation command.
4. The package manager retrieves the attacker-controlled release.
5. With the Bun command, trusted lifecycle scripts can execute during installation. Malicious runtime code can also execute when the CLI is later invoked.
6. If the hosting terminal has macOS Accessibility permission, the compromised CLI can abuse that authority to observe and control desktop applications.

Impact Assessment

Malicious installation scripts or runtime code would execute with the privileges of the installing user. Because the documented tool is intended to run from an Accessibility-enabled terminal, c ...[truncated 570 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact reviewed version, for example:

   bash

   npm install -g agent-desktop@0.1.8
   

2. Publish and verify package integrity information, such as an expected registry integrity hash or signed release artifact.
3. Remove --trust unless audited lifecycle scripts are strictly necessary. Document which scripts require trust and what each script performs.
4. Prefer a project-local installation with a committed lockfile over global installation, reducing ambiguity and limiting package resolution changes.
5. Make the executable source and dependency manifest available for review so implementation behavior can be compared with the documented capabilities.
6. Use package provenance or signature verification and a trusted, explicitly configured registry.
7. Run the CLI under a dedicated, least-privileged account or terminal context. Grant Accessibility permission only when needed and revoke it afterward.
8. Add release controls such as reproducible builds, dependency review, vulnerability scanning, and publisher-account multi-factor authentication.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises screenshot and clipboard capabilities but does not warn that these operations can capture or expose sensitive information such as passwords, tokens, personal data, or confidential application contents. In a desktop-automation context, this omission is more dangerous because the tool can access broad OS-visible state and users or calling agents may not appreciate the privacy implications before invoking it.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger text includes a broad catch-all condition ('or any desktop GUI interaction task'), which can cause the skill to activate in many situations beyond narrowly intended use. Because this skill enables powerful desktop control, overbroad activation raises the chance of unintended screenshots, UI manipulation, clipboard access, or interaction with sensitive applications when a more specific skill or safer path should have been used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation exposes a screenshot capability that can capture application windows and even return image data inline as base64, but it provides no warning about sensitive information that may be present on screen. In a desktop automation skill, this increases the risk of unintended collection, retention, or transmission of credentials, personal data, internal documents, or other confidential UI content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The notification commands allow listing notification titles/bodies and triggering actions such as Reply or Mark as Read, but the documentation does not warn that notifications often contain sensitive personal, business, or security-relevant information. In this desktop automation context, these commands could expose private content or let an agent take consequential actions on behalf of the user without adequate caution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented clipboard-get, clipboard-set, and clipboard-clear commands enable reading, overwriting, and deleting user clipboard contents without any safety guidance, consent expectations, or scope limitations. In an agent-desktop skill, clipboard data may contain passwords, API keys, personal data, or copied documents, so omission of warnings makes accidental or unauthorized access more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This documentation instructs users to grant macOS Accessibility permission, which enables broad cross-application UI inspection and control, but it does not clearly warn that this effectively gives the invoking terminal and any agent using it the ability to read sensitive on-screen content and interact with other apps. In the context of a desktop automation skill, that omission is dangerous because it normalizes granting a powerful OS capability without informed consent or guardrails, increasing the risk of credential entry manipulation, data exfiltration, or unintended destructive actions across applications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The Notification Center section explains how to read and dismiss notifications but does not warn that notifications often contain sensitive personal or enterprise data such as message previews, MFA codes, calendar details, or incident alerts. In a desktop automation skill, this is materially risky because the agent can both expose private content and alter system state by dismissing notifications that a user or operator may need to see.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.