T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/gui-automation.sh:7- Finding
Predictable and Insufficiently Protected Temporary Screenshot Storage
- Content
View full analysis
- Remediation
View remediation
Security audit
Macos Gui Automation
Security checks for vulnerabilities and agentic risk
Overview
This skill is coherent macOS GUI automation, but it grants broad screen-reading and input-control power without enough scoping, consent guidance, or safe screenshot handling.
Install only if you intentionally want an agent to read your screen and control macOS apps. Use it on bounded, non-sensitive tasks, avoid passwords, messages, financial pages, and admin prompts, and delete temporary screenshots after use. Review each automation request before allowing clicks, typing, or app control.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README explicitly instructs users to grant screen recording permission and demonstrates screenshot plus OCR commands, but it does not clearly warn that this enables capture and text extraction of potentially sensitive on-screen information such as passwords, messages, documents, or tokens. In a GUI automation skill, this capability is security-relevant because it expands the skill from simple input automation into surveillance of user-visible data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly enables screenshot capture and OCR, which can collect passwords, personal messages, financial details, API keys, and other sensitive on-screen data. Because the description presents this capability without an explicit privacy warning or guidance to avoid sensitive screens, users or downstream agents may invoke it without understanding the data exposure risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill provides powerful GUI automation primitives for clicking, typing, focusing windows, and quitting apps, but does not warn that these actions can modify files, submit forms, dismiss prompts, or trigger destructive behavior. In context, the combination of Accessibility permissions and direct input synthesis makes accidental or unsafe actions more dangerous because they can affect arbitrary applications with little friction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script captures screenshots and performs OCR on whatever is currently visible, which can include credentials, personal data, messages, or internal documents. In an agent skill context, this is more dangerous because the capability can silently collect sensitive on-screen information and expose it through command output without any user-facing consent or scope restriction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script can click, type arbitrary text, and send key presses to the GUI, enabling automated interaction with any frontmost application. In a skill/agent setting, this is high risk because it could be used to approve prompts, send messages, modify settings, trigger purchases, or operate privileged apps without meaningful user awareness.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The inline documentation for
findtextsays it will 'return coordinates' and 'Returns: x,y or nothing if not found'. However, the implementation only OCRs the screen and echoesfoundornot found, with no coordinate extraction. This is an active contradiction between documented intent and actual behavior.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The natural-language instructions and invocation examples are presented only in Chinese, which effectively forces a specific language without any opt-in or explanation of a locale-specific constraint. The policy allows fixed language use only when the user is given a choice or the locale restriction is clearly justified.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
Enumerating running processes and identifying the frontmost application exposes contextual information about the user's activity. While lower impact than capture or input injection, this still leaks potentially sensitive metadata and is more concerning in an agent skill because it can be used to profile user behavior or guide subsequent automated actions.
- Content
Static analysis
No suspicious patterns detected.