Computer Takeover

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:42 AM UTC
• Version: 1.0.0

Overview

This skill openly enables full unattended remote control of paired devices, but its camera, screen, notification, location, shell, file, app, and process controls are too powerful for the limited consent and scoping guidance provided.

Only install this for devices you own or are formally authorized to administer. Before use, require explicit consent and visible approval for screen, camera, notifications, location, shell, file transfer, app install/uninstall, process kill, and service or registry changes. Avoid using it for covert monitoring, credential access, or broad file browsing, and ensure gateway access is strongly authenticated and auditable.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:3
• Finding: Unattended High-Privilege Remote Control Without Adequate Authorization Gates<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:3, 10-21, 60-63, 66-88, 93-105, 122-131, 138-150`; `references/shell-commands.md:26-32, 38-55, 60-79, 103-129` **Vulnerability Type**: Unrestricted remote surveillance, arbitrary command execution, and privileged device administration **Risk Level**: High ### Evidence `SKILL.md:3` explicitly defines the Skill as unattended remote control that operates without user interaction: ```yaml description: "Full unattended remote control of paired devices (nodes) — screen capture, file management, shell commands, app control, camera, notifications, and process management. Use when: (1) remotely accessing or controlling a paired Windows/macOS/Android/iOS device without user interaction, (2) running commands installing apps or managing files on a remote node, (3) capturing screen or camera feeds from a remote device, (4) monitoring device health battery storage or network status, (5) automating actions on a remote device click type open app etc, (6) any form of remote desktop-style takeover or device ghosting." ``` `SKILL.md:10-21` enumerates sensitive and state-changing capabilities: ```markdown ## Core Capabilities 1. **Device Intelligence** — List nodes, get device info, health, permissions, battery, storage, network 2. **Screen Capture** — Snapshot or record the remote screen in real-time 3. **Camera Access** — Snap photos or record clips from front/back camera 4. **Shell Execution** — Run commands, scripts, and PowerShell/Bash on the remote device 5. **File Management** — Browse, read, write, delete files on the remote device via shell 6. **App Control** — Install, launch, close, list installed apps 7. **Process Management** — List running processes, kill processes, monitor CPU/memory 8. **Notifications** — Read notifications, trigger actions or replies 9. **Input Injection** — Type text, simulate clicks, keypresses (via shell automation) 10. **Location** — Get GPS coordinates (if device supports it) ...[truncated 8183 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. **Require explicit authorization** - Require fresh, device-owner approval before every camera, microphone, screen, notification, location, shell, input-injection, or file-transfer action. - Display the requesting identity, target device, requested operation, parameters, and expected duration. - Do not treat pairing alone as continuing authorization for later sensitive actions. 2. **Enforce least privilege** - Replace arbitrary PowerShell, Bash, and ADB execution with narrowly scoped, typed operations. - Grant each session only the capabilities needed for the approved task. - Run the node companion as an unprivileged account by default and require separate, time-limited elevation for administrative operations. 3. **Introduce command and resource restrictions** - Implement command allowlists and reject shell metacharacters or unapproved executables. - Restrict file access to owner-approved directories. - Block access to credential stores, SSH keys, browser profiles, tokens, operating-system secrets, and system directories by default. - Restrict package installation, registry changes, service management, process termination, and file deletion. 4. **Add operation-specific confirmation** - Require confirmation not only for destructive commands but also for sensitive reads and surveillance operations. - Require a second confirmation before file transfer, application installation, registry modification, process termination, service control, or notification replies. - Show a preview of affected paths, processes, packages, or data before execution. 5. **Provide visible device-side controls** - Display persistent indicators while screen, camera, location, notification, or shell access is active. - Provide an immediate device-side stop and revocation control. - Automatically terminate unattended sessions after a short inactivity timeout. 6. **Strengthen session and gateway security** ...[truncated 1069 chars]

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill exposes highly sensitive capabilities—unattended remote control, screen recording, camera access, notification reading, GPS, file manipulation, and shell execution—without prominent warnings, consent requirements, or abuse-prevention constraints. In this context, the absence of clear privacy and integrity safeguards makes misuse substantially more dangerous because the skill is purpose-built for covert device access and control.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The activation description is extremely broad and explicitly includes unattended remote control, screen/camera capture, shell execution, app installation, and 'device ghosting'. That makes it easy for the agent to invoke this skill for loosely related remote-access or monitoring prompts without strong scoping or consent checks, increasing the chance of unauthorized surveillance or takeover.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This reference documents process-termination commands such as Stop-Process and forceful PID kills in a skill explicitly designed for unattended remote control of devices. In that context, destructive commands can be executed on a remote node without local user awareness, causing loss of unsaved work, disruption of security tools, or service instability; the absence of warnings or guardrails materially increases misuse risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The file operation examples include writing, appending, deleting, and copying files on remote systems with no warning about user-data destruction, overwrite risk, or sensitive file access. Because this skill enables full unattended remote management, these examples can directly facilitate tampering with evidence, persistence artifacts, configuration, or personal data on paired devices.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Silent install and uninstall commands are especially risky in a remote-takeover skill because they enable software changes without user interaction or visibility. That can be abused to deploy unwanted tooling, remove protections, or alter a device state covertly; documenting this without warnings normalizes stealthy system modification.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Registry modification examples can create persistent configuration changes and are commonly used for autostart, policy alteration, or disabling protections. In an unattended remote-control context, presenting write operations without warnings significantly raises the chance of persistence abuse or long-lived system tampering.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Android install/uninstall plus screenshot and screen-recording commands are highly sensitive because they affect both device integrity and user privacy. Within a skill whose stated purpose is unattended remote takeover, these examples enable covert app deployment and direct capture of potentially confidential on-screen content without any privacy or consent warning.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Linux examples for kill -9 and systemctl restart can abruptly terminate applications or critical services, potentially causing outages, corruption, or disabling monitoring/security functions. In the context of remote device control, such commands become more dangerous because they can be issued at scale or without the device user's knowledge.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: macOS screenshot capture and forced app quit examples implicate both privacy and availability: screenshots may expose sensitive user data, and quitting apps can discard unsaved work. Because the skill is for unattended takeover, omission of privacy and data-loss warnings materially increases the risk of covert surveillance and user harm.

Static analysis

No suspicious patterns detected.