Peekaboox

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:57 PM UTC
• Version: 1.0.0

Overview

This skill openly provides broad Linux desktop control, but it lacks guardrails for actions that can expose screen contents or change real applications.

Install only if you are comfortable giving the skill broad control over an X11 desktop. Use it in a dedicated test session or VM when possible, avoid running it while sensitive apps or unsaved work are visible, inspect screenshots before acting, and require explicit user approval before hotkeys, typing, clicking destructive controls, or closing windows. The click and screenshot scripts should be hardened before use in adversarial or shared-user environments.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: click.sh:115

Finding

Command Injection Through Unvalidated Arithmetic Expressions

Content

View full analysis

Remediation

View remediation

&2 exit 1 fi ``` Perform validation before both direct `xdotool` use and window-relative arithmetic. Validate values obtained from `xdotool` as well: ```bash if ! [[ "$WIN_X" =~ ^-?[0-9]+$ ]] || ! [[ "$WIN_Y" =~ ^-?[0-9]+$ ]]; then echo "ERROR: invalid window geometry" >&2 exit 1 fi ``` Additional hardening should include: 1. Enforce sensible upper and lower coordinate bounds. 2. Apply strict integer validation to `--amount`, `--delay`, `--width`, `--height`, and other numeric parameters in the remaining scripts. 3. Avoid evaluating untrusted strings as arithmetic expressions. 4. Add regression tests using arithmetic metacharacters, command substitutions, array syntax, whitespace, signs, and oversized values. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: capture.sh:52

Finding

Predictable Screenshot Filename Enables Symlink-Based File Overwrite

Content

View full analysis

&2 fi exit 1 fi # Try import (ImageMagick) first for window-specific capture, fall back to scrot if command -v import &>/dev/null; then import -window "$WIN_ID" "$OUTPUT" else # Focus the window then use scrot -u (focused window) xdotool windowactivate --sync "$WIN_ID" sleep 0.3 scrot -u "$OUTPUT" fi else # Full screen capture scrot "$OUTPUT" fi ``` ### Technical Analysis The default screenshot path is placed in the globally shared `/tmp` directory and contains only the current Unix timestamp in seconds. This filename is predictable and provides a large race window because every invocation within the same second uses the same path. The script does not atomically reserve the destination, create a private temporary directory, reject symbolic links, or confirm that the destination is a newly created regular file owned by the invoking user. If the screenshot backend follows an existing symbolic link when writing its output, a local attacker can redirect the write to another file writable by the victim. The same naming strategy can also cause collisions between concurrent legitimate executions. ### Attack Path 1. A local attacker predicts the timestamp at which the victim will run `capture.sh`. 2. The ...[truncated 1256 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description presents a comprehensive X11 desktop GUI automation skill, but the supplied code chunk implements only screenshot capture functionality. It can capture the full screen or a specific window by name and depends on X11 tools such as xdotool, scrot, and optionally ImageMagick import. There is no evidence in this chunk of input automation, UI clicking, text entry, shortcut sending, scrolling, or general window management beyond activating a window as part of capture fallback. This is a material description-to-behavior mismatch because the declared purpose substantially overstates the capabilities demonstrated by the code provided.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description promises a broad desktop automation and control skill for X11, including interaction and manipulation of GUI elements and windows. The supplied code chunk does not implement those capabilities. It only queries window metadata and the active window using wmctrl, xdotool, and xprop, then formats the results as JSON. While window inspection could be a supporting component of a larger automation skill, this code chunk by itself materially differs from the declared purpose because it lacks the core automation behaviors described.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 21)May include surrounding context.

sh

elif command -v dnf &>/dev/null; then
    sudo dnf install -y xdotool wmctrl scrot xorg-x11-utils ImageMagick python3 python3-pip
elif command -v pacman &>/dev/null; then
    sudo pacman -S --noconfirm xdotool wmctrl scrot xorg-xwininfo imagemagick python python-pip
else
    echo "ERROR: Unsupported package manager. Install manually: xdotool wmctrl scrot" >&2
    exit 1

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide explicitly instructs taking screenshots of the live desktop but provides no warning that screenshots may capture sensitive information such as emails, chats, credentials, documents, or other user data visible on screen. In a desktop automation skill, this creates a real privacy and data-exposure risk because users may test against their normal session rather than an isolated environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document directs users to click, type, send hotkeys, scroll, and manipulate windows in a live GUI session without warning that these actions can affect real applications, trigger unintended commands, or alter user data. Because the skill is specifically designed to control the desktop, misuse or accidental execution in the wrong window can cause data loss, unintended actions, or interaction with privileged prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README advertises full desktop automation capabilities that can click, type, send hotkeys, and manage windows, but it does not warn users that these actions can change system state, dismiss dialogs, or trigger unintended operations. In a GUI automation skill, lack of safety guidance materially increases the chance of accidental destructive use, especially by agents acting autonomously from screenshots and coordinates.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly documents hotkeys and window-management features including close operations, but provides no warning that closing windows or sending shortcuts like Alt+F4/Ctrl+C may terminate processes or discard unsaved work. Because this skill is intended for active desktop control, documenting destructive capabilities without caution makes accidental harmful use more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill enables arbitrary GUI interaction including typing, hotkeys, window closing, and clicking, which can cause destructive actions, credential entry into the wrong window, or unintended command execution if used without prominent safety constraints. In this context, broad desktop-control capability increases risk because X11 automation can affect any visible application in the session, making operator mistakes or misuse materially more dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script passes an attacker-controlled key sequence directly to xdotool, allowing arbitrary hotkeys to be injected into the active X11 session. In the context of a desktop-control skill, this can trigger destructive actions such as closing applications, invoking terminal shortcuts, locking/logging out the session, approving dialogs, or driving privileged UI flows without any confirmation or policy checks.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 16)May include surrounding context.

sh

# Detect package manager and install system packages
if command -v apt-get &>/dev/null; then
    sudo apt-get update -q
    sudo apt-get install -y xdotool wmctrl scrot x11-utils imagemagick python3 python3-venv python3-pip
elif command -v dnf &>/dev/null; then
    sudo dnf install -y xdotool wmctrl scrot xorg-x11-utils ImageMagick python3 python3-pip

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 17)May include surrounding context.

sh

# Detect package manager and install system packages
if command -v apt-get &>/dev/null; then
    sudo apt-get update -q
    sudo apt-get install -y xdotool wmctrl scrot x11-utils imagemagick python3 python3-venv python3-pip
elif command -v dnf &>/dev/null; then
    sudo dnf install -y xdotool wmctrl scrot xorg-x11-utils ImageMagick python3 python3-pip

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 19)May include surrounding context.

sh

# Detect package manager and install system packages
if command -v apt-get &>/dev/null; then
    sudo apt-get update -q
    sudo apt-get install -y xdotool wmctrl scrot x11-utils imagemagick python3 python3-venv python3-pip
elif command -v dnf &>/dev/null; then
    sudo dnf install -y xdotool wmctrl scrot xorg-x11-utils ImageMagick python3 python3-pip

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 21)May include surrounding context.

sh

# Detect package manager and install system packages
if command -v apt-get &>/dev/null; then
    sudo apt-get update -q
    sudo apt-get install -y xdotool wmctrl scrot x11-utils imagemagick python3 python3-venv python3-pip
elif command -v dnf &>/dev/null; then
    sudo dnf install -y xdotool wmctrl scrot xorg-x11-utils ImageMagick python3 python3-pip

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 65% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · install.sh (reported line 21)May include surrounding context.

sh

elif command -v dnf &>/dev/null; then
    sudo dnf install -y xdotool wmctrl scrot xorg-x11-utils ImageMagick python3 python3-pip
elif command -v pacman &>/dev/null; then
    sudo pacman -S --noconfirm xdotool wmctrl scrot xorg-xwininfo imagemagick python python-pip
else
    echo "ERROR: Unsupported package manager. Install manually: xdotool wmctrl scrot" >&2
    exit 1

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The close action can terminate an application window and potentially cause loss of unsaved user work, but this code path provides no confirmation prompt or explicit user-facing warning before executing wmctrl -c or xdotool windowclose. While the help text lists the action, it does not disclose the risk of data loss associated with closing a window.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.