Security audit

Mac Control

Security checks for vulnerabilities and agentic risk

Overview

The skill broadly matches its Mac UI automation purpose, but it needs Review because its scripts can generate real clicks, capture screens, leave screenshots behind, and contain an AppleScript injection flaw.

Install only if you are comfortable granting an agent practical control over your Mac UI and screen contents. Use it for tightly scoped, user-directed automation, avoid passing untrusted application names into its scripts, and treat screenshots saved under /tmp or calibration files under ~/.clawdbot as potentially sensitive. The package should be reviewed or hardened before use on accounts that handle private, financial, administrative, or security-sensitive workflows.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/get-window-bounds.sh:24
Finding: AppleScript Injection Through an Untrusted Application Name
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/calibrate.sh:7
Finding: Predictable Temporary Directory Used for Calibration Screenshot
Content: View full analysis
Remediation: View remediation
&2 exit 1 } trap 'rm -rf -- "$TMP_DIR"' EXIT HUP INT TERM ``` Additional hardening should include: 1. Verify that screenshot creation succeeds before processing the image. 2. Avoid `mkdir -p` for security-sensitive temporary directories. 3. Quote all references to temporary paths. 4. Keep screenshots only for the minimum time necessary. 5. Ensure the calibration directory under the user’s home directory is also created with user-only permissions where appropriate. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/find-element.sh:7
Finding: Predictable Temporary Directory and Persistent Full-Screen Capture
Content: View full analysis
/dev/null echo "Cropped image: $TMP_DIR/cropped.png" echo "" echo "To view: open $TMP_DIR/cropped.png" echo "Full screenshot: $TMP_DIR/full.png" # Output paths for scripting echo "FULL=$TMP_DIR/full.png" echo "CROPPED=$TMP_DIR/cropped.png" ``` ### Technical Analysis The script uses a predictable process-ID-based path under the shared `/tmp` directory and creates it with `mkdir -p`. It does not atomically establish directory ownership, set a restrictive `umask`, or verify that the path was not created by another local user. The script captures the entire screen into `full.png` and creates an additional cropped image. Unlike the calibration script, it provides no cleanup operation or expiration mechanism. Both images remain in the temporary directory after the script exits. The combination of predictable naming and retained full-screen captures increases the opportunity for local information disclosure. A local attacker may pre-create or race the directory and then access the resulting images. Even without active exploitation, residual screenshots can remain readable longer than required. The unquoted numeric crop arguments at line 79 also lack validation, but the confirmed security exposure is the unsafe storage and retention of screenshots. ### Attack Path 1. A local attacker predicts or observes the PID-derived directory name. 2. The attacker creates `/ ...[truncated 1067 chars]
Remediation: View remediation
&2 exit 1 } trap 'rm -rf -- "$TMP_DIR"' EXIT HUP INT TERM ``` If retaining screenshots is a required feature, use an explicit opt-in option instead of retaining them by default: 1. Delete full and cropped screenshots automatically when the script exits. 2. Add a `--keep` or `--output-dir` option for intentional retention. 3. Require any caller-provided output directory to be owned by the current user and not writable by other users. 4. Create retained files with user-only permissions. 5. Warn users that full-screen captures may contain sensitive information. 6. Validate `CX`, `CY`, `CW`, and `CH` as non-negative integers and quote them when passing them to `sips`. 7. Check the exit status of `screencapture` and `sips` before printing output paths. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is focused on Mac UI automation and interaction with on-screen elements through mouse/keyboard automation tools. The supplied code does not perform any UI automation at all. Instead, it implements offline image processing: it takes an input image, checks dimensions, copies it, and crops a region using sips. While image cropping could conceivably support screenshot workflows, this code chunk’s primary behavior is file-based image manipulation, which is a materially different capability from the declared purpose and omits the core declared behaviors entirely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill performs direct mouse and keyboard automation, including clicking dialogs, typing text, and activating focused elements, but does not prominently warn that synthetic input can trigger unintended or irreversible UI actions. In this context, a missed target, stale coordinates, or focus change could approve prompts, submit forms, close windows, or alter settings unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill performs direct mouse and keyboard automation, including clicking dialogs, typing text, and activating focused elements, but does not prominently warn that synthetic input can trigger unintended or irreversible UI actions. In this context, a missed target, stale coordinates, or focus change could approve prompts, submit forms, close windows, or alter settings unexpectedly.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The header comments and progress messages describe this as a calibration routine that discovers the real coordinate scale factor through screenshot-based analysis. However, the image-analysis steps are not implemented, and L45 hard-codes SCALE_FACTOR="2.5", meaning the script does not do what its documentation says it does.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script captures a screenshot with the cursor and persists calibration data to the user's home directory without any explicit notice, consent flow, or minimization of what may be captured. In the context of a UI automation skill, screenshots can contain sensitive on-screen information from unrelated apps, making silent capture and storage a meaningful privacy risk even if the immediate script intent appears operational rather than malicious.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script directly invokes cliclick to generate real mouse events on the host without any confirmation, dry-run mode, bounds validation, or focused-window verification. In a UI automation skill, that means a caller can trigger unintended clicks on sensitive dialogs, permission prompts, security settings, or destructive UI elements, especially if coordinates are stale or manipulated.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest and top-level documentation describe this skill as controlling the Mac using cliclick and AppleScript, plus screenshots/window bounds. Line L271 introduces an additional automation capability via Python and pyautogui, which is not declared as part of the skill's stated toolset or purpose-specific implementation details.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.