Screen Monitor

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

The agent could perform actions in websites or accounts open in Chrome if the browser relay is attached.

Why it was flagged

The skill explicitly enables the agent to click/type in an attached Chrome tab, which may use the user’s logged-in browser session, but it does not define approval, domain, or action limits.

Skill content

Full Control (Browser Relay) ... UI automation, and clicking/typing in tabs. ... browser action:click: Interact with elements (requires profile="chrome").

Recommendation

Use this mode only on trusted pages, require confirmation before clicks or typing, and avoid attaching tabs with sensitive or high-impact accounts unless needed.

ConcernHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Running analysis when the portal is inactive may still capture the whole desktop, including private information visible on screen.

Why it was flagged

If no portal frame exists, the analysis script falls back to taking a full OS screenshot. That is sensitive screen access and is not clearly gated by an explicit user approval step in the skill instructions.

Skill content

echo "No portal active. Taking OS screenshot..."
import -window root "$SCREENSHOT"
...
screencapture -x "$SCREENSHOT"

Recommendation

Disable the OS screenshot fallback by default or require an explicit user confirmation before taking a desktop screenshot.

ConcernHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

A local web page or network peer that can reach the service may overwrite what the agent analyzes, potentially confusing the agent or injecting misleading visual context.

Why it was flagged

The frame-ingest endpoint accepts POSTs from any browser origin and writes the submitted image as the latest screen frame, with no token, authentication, or origin binding shown.

Skill content

res.setHeader('Access-Control-Allow-Origin', '*');
...
if (req.url === '/api/screen-frame' && req.method === 'POST') {
...
fs.writeFileSync(FRAME_PATH, buffer);

Recommendation

Bind the backend to localhost unless remote access is explicitly needed, add a per-session token, restrict CORS, and validate request size and origin.

ConcernHigh Confidence

ASI06: Memory and Context Poisoning

What this means

A previous screen frame may remain on disk and be analyzed later even after the user believes sharing has stopped.

Why it was flagged

The analysis script treats any existing frame file as an active screen-share frame, with no freshness, source, or deletion check.

Skill content

FRAME_PATH="/tmp/clawdbot-screen-latest.png"

if [ -f "$FRAME_PATH" ]; then
    echo "Found active WebRTC frame. Analyzing..."
    SCREENSHOT="$FRAME_PATH"

Recommendation

Delete or expire the frame when sharing stops, store it in a private per-session location, and check timestamps before reuse.