MacOS Desktop Control (Mouse, Keyboard, Screenshots)
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: macos-desktop-control Version: 1.0.0 The skill provides macOS desktop control capabilities, including mouse/keyboard interaction and screen capture. The `scripts/cliclick_wrapper.sh` directly passes all arguments to the `cliclick` utility using `"$@"`. This design creates a significant shell injection vulnerability (RCE risk) if the OpenClaw agent does not rigorously sanitize user-provided input before invoking the `click` tool. While not explicitly malicious code designed for self-exploitation or data exfiltration, this direct pass-through of arguments without apparent sanitization constitutes a high-risk vulnerability, classifying it as suspicious.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If invoked incorrectly or too freely, the agent could click buttons, type text, submit forms, delete data, or operate sensitive apps on the user's desktop.
The wrapper forwards arbitrary arguments directly to cliclick, enabling mouse and keyboard emulation without artifact-shown validation, scoping, or approval checks.
/opt/homebrew/bin/cliclick "$@"
Use only with active supervision, require confirmation before clicks or typing in sensitive apps, and consider adding an allowlist or safer wrapper that restricts commands and coordinates.
Sensitive information visible on the screen could be saved locally in the screenshot file.
The skill captures the full current screen to a fixed local file path; screen contents may include private or sensitive information, and the artifacts do not show cleanup or redaction.
screencapture -x /tmp/claw_view.png
Close or hide sensitive windows before use, review what is visible on screen, and delete /tmp/claw_view.png when no longer needed.
Users may not realize they need to install and trust an external desktop-control utility for the skill to work.
The skill depends on an external Homebrew-installed binary, while the supplied registry metadata declares no required binaries and there is no install specification.
brew install cliclick
Install cliclick only from a trusted source, verify the binary path, and update the skill metadata to declare the macOS and cliclick requirements.