Back to skill

Security audit

Desktop Control

Security checks for vulnerabilities and agentic risk

Overview

This desktop automation skill is mostly coherent, but it gives broad live-desktop control with incomplete approval coverage and weak handling of screenshots, clipboard data, and typed secrets.

Install only if you are comfortable giving the skill broad control over your active desktop. Keep failsafe enabled, avoid using it around passwords or confidential documents, do not rely on approval mode as covering every sensitive action, review logs and saved screenshots, and use a virtual environment with pinned dependency versions where possible.

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Warning
Location
__init__.py:123
Finding

Approval Mode Does Not Protect All Sensitive Operations

Content
View full analysis
None: if x is not None and y is not None: pyautogui.moveTo(x, y) if direction == 'vertical': pyautogui.scroll(clicks) else: pyautogui.hscroll(clicks) logger.debug(f"Scrolled {direction} {clicks} clicks") def key_down(self, key: str) -> None: """Press and hold a key without releasing.""" pyautogui.keyDown(key) logger.debug(f"Key down: '{key}'") def key_up(self, key: str) -> None: """Release a held key.""" pyautogui.keyUp(key) logger.debug(f"Key up: '{key}'") def screenshot(self, region: Optional[Tuple[int, int, int, int]] = None, filename: Optional[str] = None): img = pyautogui.screenshot(region=region) if filename: img.save(filename) logger.info(f"Screenshot saved to: {filename}") else: logger.debug(f"Screenshot captured (region={region})") return img def copy_to_clipboard(self, text: str) -> None: try: import pyperclip pyperclip.copy(text) logger.info(f"Copied to clipboard: '{text[:50]}...'") except ImportError: logger.error("pyperclip not installed. Run: pip install pyperclip") except Exception as e: logger.error(f"Error copying to clipboard: {e}") def get_from_clipboard(self) -> Optional[str]: try: import pyperclip text = pyperclip.paste() logger.debug(f"Got from clipboard: '{text[:50]}...'") return text except ImportError: logger.error("pyperclip not installed. Run: pip install pyperclip") return None except Exception as e: log ...[truncated 1997 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
__init__.py:153
Finding

Typed and Clipboard Content Is Exposed Through Application Logs

Content
View full analysis
None: """ Type text with configurable speed. Args: text: Text to type interval: Delay between keystrokes (0 = instant) wpm: Words per minute (overrides interval, typical human: 40-80 WPM) """ if wpm is not None: # Convert WPM to interval (assuming avg 5 chars per word) chars_per_second = (wpm * 5) / 60 interval = 1.0 / chars_per_second if self._check_approval(f"type text: '{text[:50]}...'"): pyautogui.write(text, interval=interval) logger.info( f"Typed text: '{text[:50]}{'...' if len(text) > 50 else ''}' " f"(interval={interval:.3f}s)" ) def copy_to_clipboard(self, text: str) -> None: """ Copy text to clipboard. Args: text: Text to copy """ try: import pyperclip pyperclip.copy(text) logger.info(f"Copied to clipboard: '{text[:50]}...'") except ImportError: logger.error("pyperclip not installed. Run: pip install pyperclip") except Exception as e: logger.error(f"Error copying to clipboard: {e}") ``` ### Technical Analysis The controller records up to the first 50 characters of typed and copied content at INFO level. The project documentation explicitly demonstrates form filling, password entry, email text, and clipboard manipulation. Consequently, these values may include passwords, access tokens, personal information, recovery codes, or confidential business data. INFO logs are commonly enabled in production and may be retained in terminal history, service logs, diagnostic archives, or centralized logging systems. Truncating data to 50 characters is not mea ...[truncated 1267 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
ai_agent.py:357
Finding

Unvalidated Application Value Can Be Executed Through the Windows Run Dialog

Content
View full analysis
None: """Launch an application.""" # Get launch command from knowledge base app_info = self.app_knowledge.get(app, {}) launch_cmd = app_info.get("launch_command", app) # Open Run dialog self.dc.hotkey('win', 'r') time.sleep(0.5) # Type and execute command self.dc.type_text(launch_cmd, wpm=100) self.dc.press('enter') logger.info(f"Launched: {app}") ``` The dispatch path accepts a step-provided application value: ```python if step_type == "launch_app": self._do_launch_app(step["app"]) result["success"] = True ``` ### Technical Analysis Known applications are mapped to fixed launch commands, but unknown values fall back to the original `app` string: ```python launch_cmd = app_info.get("launch_command", app) ``` That string is entered verbatim into the Windows Run dialog and executed by pressing Enter. Therefore, the `app` field functions as a command string rather than a constrained application identifier. The normal natural-language planner currently resolves unknown application requests to Notepad, reducing exposure through that specific path. However, `_execute_step()` accepts a caller-supplied dictionary, and the documentation presents individual step execution as a manual API. Future LLM integration could also make generated step content untrusted. Any caller able to supply a `launch_app` step can therefore reach the unsafe fallback. ### Attack Path 1. An integration, plugin, future LLM planner, or other untrusted caller can invoke `_execute_step()` with a crafted step. 2. The caller supplies: ```python { "type": "launch_app", "app": "" } ``` 3. `_do_launch_app()` fails to find the value in `app_knowle ...[truncated 760 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:56
Finding

Installation Instructions Use Unpinned Third-Party Dependencies

Content
View full analysis
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide states that the agent takes screenshots and later shows screenshot retention in results, but it does not warn that captures may include passwords, personal data, confidential documents, or other sensitive on-screen material. Because this is a desktop automation skill with broad screen visibility, silent capture and storage materially increases privacy and data-exposure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guide presents disabling the failsafe as a simple configuration option without prominently warning that this removes an important control against runaway or misdirected autonomous input. In a tool that can drive mouse and keyboard across arbitrary desktop applications, removing the failsafe can amplify mistakes into uncontrolled clicks, typing, file changes, or irreversible user actions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description frames the skill as desktop automation, but the documented capabilities extend into privacy- and control-sensitive areas such as window enumeration, clipboard read/write, and user prompt/approval flows. This mismatch can cause operators or policy systems to under-estimate the skill’s access level, making it easier to deploy a capability that can inspect sensitive context and manipulate the active desktop beyond what the summary suggests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The guide frames the agent as able to understand and autonomously execute arbitrary natural-language desktop tasks without describing clear scope restrictions, confirmation requirements, or trust boundaries. In a desktop-control skill, this increases the chance that ambiguous or casually phrased user input could trigger impactful real-world actions such as launching apps, typing content, or manipulating UI state.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Example phrases like broad text-entry requests are underspecified and resemble ordinary conversation, making intent detection error-prone. For an autonomous desktop agent, weakly specific triggers can cause unintended execution in the wrong application or context, leading to accidental data entry, message sending, or workflow disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The file and data-handling examples encourage autonomous operations on user content without warning about accidental overwrites, corruption, unintended disclosure, or actions on the wrong files. In a desktop agent context, autonomous file manipulation is especially risky because mistakes directly affect real user data and may be difficult to undo.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The documentation provides screenshot capture and file-saving examples without any privacy, consent, or sensitive-data handling guidance. Because this skill is specifically for desktop control, screenshots may capture credentials, personal data, internal documents, or other sensitive on-screen content, and saving them to disk increases persistence and exposure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The quick reference explicitly shows DesktopController(failsafe=False) as a maximum-speed option and labels it as having 'no safety checks' without an adequate warning about the risks. In a desktop automation skill, disabling failsafes can allow unintended clicks, keystrokes, window switching, or destructive actions to continue without an easy abort path, increasing the chance of harmful or uncontrolled system interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documents comprehensive mouse and keyboard automation, including clicks, drags, hotkeys, and text entry, but does not clearly warn that these actions can modify files, submit forms, trigger system shortcuts, or otherwise change system state destructively. In a desktop-agent setting, simulated input is especially risky because it operates with the user’s ambient privileges and can affect whichever window is focused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation advertises screenshot capture, image recognition, pixel inspection, and clipboard access without an explicit privacy warning. These features can expose passwords, personal data, tokens, messages, or confidential business information from the screen or clipboard, especially in an agent context where actions may be automated at scale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Screenshot capture can collect highly sensitive on-screen information, including emails, credentials, financial data, or private documents, and saving images to disk increases persistence and exposure. Because this occurs without approval or a prominent warning, the skill can silently surveil the user environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

Window enumeration and activation allow the skill to inspect application titles and manipulate desktop focus, which goes beyond basic mouse/keyboard/screen control as described. This can reveal sensitive context such as open apps/documents and can be used to redirect subsequent keystrokes or clicks into unintended windows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description limits scope to mouse, keyboard, and screen automation, but the implementation also reads from and writes to the system clipboard. Clipboard contents often contain passwords, tokens, private messages, or copied documents, so adding this capability materially expands data-access scope beyond the stated purpose and creates a covert exfiltration/privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Clipboard writes can overwrite user data and facilitate staging of sensitive or deceptive content for later paste operations, especially when combined with keyboard automation. Without approval or warning, this can unexpectedly alter user workflow or inject harmful commands, URLs, or text into other applications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The agent autonomously interprets natural-language tasks and then launches applications, sends keystrokes, and performs mouse actions on the user's live desktop without any explicit consent flow, risk acknowledgment, or constrained permission model. In a desktop-automation skill, this is materially dangerous because ambiguous or unsafe prompts can trigger unintended system interaction, application launches, or input into the wrong window, enabling misuse or destructive actions even if the feature is presented as convenience automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code captures full desktop screenshots before and after each action and stores them in the returned result structure without a clear user-facing privacy notice or consent mechanism. Desktop screenshots can contain highly sensitive information such as emails, documents, passwords, tokens, chats, or regulated data, so collecting them by default increases privacy and data-exposure risk substantially.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The screenshot step writes image files to disk using a default filename without any explicit warning, storage policy, or access protections. Persisting desktop screenshots on disk creates durable artifacts that may expose sensitive on-screen content to other local users, backup systems, malware, or later accidental disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The demo captures screenshots and writes them to disk automatically, including a full-screen image, without an explicit confirmation immediately before the sensitive action. In a desktop automation skill, screenshots can contain secrets, personal data, or other application content, so persisting them to files increases privacy and data exposure risk if the user did not fully understand what would be captured.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The demo reads the current clipboard, overwrites it with new content, and prints clipboard values to the console after only a generic prompt to continue. Clipboard data often contains passwords, tokens, personal information, or business data, so reading, displaying, and modifying it without a strong privacy warning and explicit scoped consent creates a real confidentiality and integrity risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

Activating a window changes the user's active context and can cause subsequent automated input to be sent to a different application than expected. On its own this is lower impact, but in a desktop automation skill it increases the chance of unintended or misleading interactions if performed silently.

Content

No source excerpt is available for this finding.