Security audit

Desktop Control

Security checks across malware telemetry and agentic risk

Overview

This desktop automation skill is mostly purpose-aligned, but it gives broad control over the user's desktop with weak default consent boundaries.

Install only if you intentionally want an agent to control your desktop. Use failsafe on, prefer require_approval=True, avoid running it around passwords or private documents, and review any autonomous task plan before allowing typing, clicking, screenshots, clipboard reads, app launches, or public posting workflows.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 84% confidence
Finding: The skill advertises desktop automation, but the documented capabilities extend into more sensitive behaviors such as window enumeration/activation, clipboard access, and examples that can be used to launch applications or drive arbitrary UI flows. This matters because users and higher-level agents may grant the skill more trust than warranted, enabling privacy-invasive or system-modifying actions under an underspecified description.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The guide advertises high-risk capabilities well beyond basic desktop control, including social media posting, web workflows, and file-processing tasks. In an autonomous desktop agent, overstating or enabling broader operational scope can lead to unauthorized actions, data exposure, or destructive changes because users may invoke capabilities without appropriate safeguards, permissions, or boundary checks.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The guide inconsistently claims current screen-understanding and analysis features while later describing computer vision as only planned. This mismatch can cause operators or downstream agents to rely on nonexistent validation or perception controls, increasing the chance of unsafe autonomous actions based on false assumptions about what the system can actually detect or verify.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill advertises mouse, keyboard, and screen control but also includes window enumeration/activation and clipboard access, which expands its effective privilege and data-access scope beyond the stated purpose. This matters because hidden capability expansion can enable collection of sensitive application context or manipulation of user data in ways a caller may not expect.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Clipboard read/write access is sensitive because it can expose secrets such as passwords, tokens, copied documents, or overwrite user data without notice. In a desktop automation skill, this is more dangerous because clipboard functions are not clearly necessary for the stated mouse/keyboard/screen purpose and can be abused for data theft or tampering.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The demo performs clipboard read and write operations even though the stated skill description only mentions mouse, keyboard, and screen control. Clipboard contents may contain sensitive data such as passwords, tokens, or personal information, so undeclared access expands the skill's effective capability and can surprise users or downstream agents relying on the manifest for trust decisions.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The demo launches an application through the OS Run dialog, which goes beyond passive desktop control examples and enters process execution territory. Even though it only starts Notepad here, undeclared app-launch capability materially increases risk because the same mechanism could be used to execute other commands or programs on the host.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The guide promotes autonomous screenshot capture and saving but does not warn users that screenshots may collect sensitive on-screen information such as credentials, personal data, or confidential documents. In a desktop automation context, silent capture and storage materially increases privacy and data-leakage risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation includes autonomous file operations without warning that user files may be modified, overwritten, moved, or deleted. In an autonomous agent with keyboard/mouse control, file actions can quickly cause irreversible data loss or unintended access to sensitive content if the task is misunderstood.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide demonstrates automated social-media posting without warning that content may be transmitted to third-party services under the user's identity. This is dangerous because autonomous posting can leak private information, damage reputation, or trigger account abuse if prompts are ambiguous or manipulated.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The guide documents disabling the failsafe and presents it as a performance option without adequately warning that it removes a key safety mechanism against uncontrolled input automation. For a desktop agent that can autonomously click, type, and navigate applications, disabling failsafe materially raises the risk of runaway actions, unintended commands, and user lockout.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The quick reference normalizes screenshot capture, window enumeration, and clipboard reads/writes without clearly warning that these operations may access sensitive information such as passwords, personal data, tokens, or confidential documents. In a desktop automation skill, these capabilities are inherently privacy-sensitive because they can collect or expose data from unrelated applications if used carelessly or repurposed by downstream agents.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The examples demonstrate actions like submitting forms, switching windows, copying files, launching applications, and bulk replace operations without a prominent warning to verify window focus, target selection, and safe test conditions first. In GUI automation, misdirected keystrokes or clicks can cause unintended destructive actions, data leakage, or modification of the wrong application because execution depends heavily on the current desktop state.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The feature list includes screenshot capture, image recognition, pixel inspection, and clipboard operations, but it does not prominently warn that these features can collect sensitive information such as passwords, tokens, personal data, or confidential on-screen content. In a desktop-control skill, omission of these privacy warnings increases the chance of unsafe use or overbroad delegation by users and agents.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The examples demonstrate saving screenshots to disk without warning that captured images may contain sensitive information and create persistent local artifacts. Persisting screenshots can increase exposure by leaving confidential data on disk where it may be copied, indexed, or accessed later by other users or processes.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The scroll method performs UI input without using the approval mechanism that other interactive actions rely on. Unprompted scrolling can change application state, navigate away from content, trigger lazy-loaded actions, or contribute to chained UI automation without the user's awareness.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: key_down and key_up generate keyboard state changes without confirmation, allowing hidden modifier holds or keystroke sequences that can alter system behavior. Because held keys can be combined with later actions, they are particularly risky in desktop automation and can enable stealthier command execution or disruptive interactions.

Missing User Warnings

High

Confidence: 97% confidence
Finding: Screenshot capture can expose highly sensitive on-screen information, including credentials, personal data, internal documents, or messages, and saving to a file creates a durable artifact that can later be exfiltrated. In a desktop-control skill, this is especially dangerous because screen access is a direct observation channel and the method does not require approval or provide warning.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Clipboard writes modify user state silently and can overwrite important copied content, inject misleading data, or stage follow-on attacks by replacing what the user is likely to paste next. Because there is no approval check, the action can occur invisibly during automation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The quick-access wrappers create or reuse a global controller with approval disabled by default, making potentially sensitive desktop actions one-call operations without any consent barrier. This weakens all higher-risk functions by encouraging unsafe defaults and bypassing the safer configuration path.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This agent autonomously captures screenshots, types into applications, and performs GUI actions based on a natural-language task without any explicit consent, confirmation, scope restriction, or safety interlock. In a desktop automation skill, that creates a real risk of unintended data entry, interaction with sensitive windows, and collection of sensitive on-screen information if the task is malicious, ambiguous, or simply misinterpreted.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The launch routine opens the OS Run dialog, types a command, and presses Enter, which is effectively local command execution through simulated keystrokes. Because the app name can come from task parsing and falls back to raw input when not in the knowledge base, this can start arbitrary programs or trigger unintended OS actions without informing the user or constraining what may be launched.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.