Security audit
Security checks for vulnerabilities and agentic risk
This Windows desktop automation skill is openly described, but it grants broad control over apps, input, screenshots, clipboard, processes, and VS Code extensions without enough built-in scoping or confirmation.
Install only if you intentionally want an agent to control your Windows desktop. Treat screenshot, clipboard, keyboard, mouse, process-kill, and VS Code extension actions as sensitive; review each planned action, confirm destructive or persistent changes, and avoid using it while private windows, secrets, admin prompts, terminals, or messaging apps are in focus.
scripts/vscode-control.ps1.txt:172Unverified VS Code Extension Installation
scripts/vscode-control.ps1.txt:58Unverified Window Focus Before Global Keystroke Injection
The skill documents screenshot capture and clipboard reading without requiring an explicit user warning/confirmation at the point of use, even though both actions can expose secrets, personal data, tokens, messages, or proprietary information from unrelated applications. In a desktop-control skill, these capabilities are especially sensitive because they can silently access data outside the app the user intended to automate.
The skill description is extremely broad ('control desktop applications', 'simulate keyboard/mouse input', 'read clipboard', 'capture screen info') and maps to many ordinary user requests, which increases the chance the agent invokes a highly privileged skill in situations where a narrower, safer capability would suffice. Because this skill can affect arbitrary applications and access sensitive on-screen or clipboard data, over-broad routing materially raises the risk of unintended data exposure or destructive actions.
This script directly simulates keyboard and mouse input against whichever window is focused, including arbitrary text entry, shortcut execution, clicks, and scrolling, with no confirmation, allowlist, target validation, or safety interlocks. In a desktop-control skill, that can trigger destructive actions such as closing applications, approving prompts, deleting data, sending messages, or interacting with privileged/system dialogs if the wrong window has focus or parameters are attacker-influenced.
The kill action performs potentially destructive process termination, including forced termination, without any confirmation prompt or prior warning comment/docstring. Although it prints after the action completes, that does not disclose the risk beforehand and may lead to accidental termination of the wrong process, especially with name-based matching.
The new-terminal action force-focuses a window identified by title and sends the Ctrl+` keystroke sequence globally. Keystroke injection tied only to window focus is unsafe in an agent skill because focus can race or be stolen, causing the shortcut to land in the wrong application or enabling follow-on command execution in a newly opened terminal context.
The command-palette action force-focuses VSCode and sends Ctrl+Shift+P without any confirmation or robust validation of the active target. In the context of a desktop-control skill, global synthetic keystrokes are inherently risky because they can affect the wrong window and are often chained with later text input to drive sensitive actions.
The run-command action accepts arbitrary command IDs and then force-focuses VSCode, opens the command palette, types the supplied string, and presses Enter. In a desktop-control skill, this enables execution of potentially dangerous editor or extension-provided commands without confirmation, and because it relies on GUI keystroke injection, a focus mistake or maliciously chosen command can trigger unintended actions in the active UI context.