ClawHub
Back to skill

Security audit

Mcp Control

Security checks for vulnerabilities and agentic risk

Overview

This skill openly provides powerful local browser and Windows desktop control, but it depends on unaudited external helpers and exposes arbitrary shell and PowerShell execution without clear built-in limits.

Install only if you intentionally want an agent to control your local Windows desktop and a debug Edge profile. Use a dedicated non-personal browser profile, avoid sensitive logged-in accounts, review the external helper files before running them, and treat windows run, windows ps, clipboard, screenshot, and browser eval operations as privileged actions that should require explicit approval.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:8
Finding

Unverified External Helpers Expose Arbitrary Command Execution and Authenticated Desktop Access

Content
View full analysis
Capture full screen to PNG click Left-click at coords dblclick Double-click rightclick Right-click move Move mouse scroll Scroll wheel (+ up, - down) type Type unicode text (clipboard paste) key Press a key chord Key chord (e.g. "ctrl+c", "alt+F4") windows List visible top-level windows find ...[truncated 4055 chars]
Remediation
View remediation
` and `ps

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

This is a real dangerous capability: the skill explicitly exposes windows run and windows ps, which allow arbitrary shell and PowerShell execution on the local machine. In the context of an agent skill for browser and desktop control, that materially expands the attack surface from UI automation into full code execution, enabling file access, persistence, data theft, or system modification if the skill is invoked unsafely or influenced by adversarial prompts/content.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md
## Safety notes

- `windows run` and `windows ps` execute arbitrary commands. Treat them like a shell.
- Screenshots and click events affect the user's actual desktop.
- `windows activate` will switch the foreground window out from under the user.
- `playwright-cli` over CDP sees and acts on whatever's open in the connected

Static analysis

No suspicious patterns detected.