Security audit

Screenclaw

Security checks for vulnerabilities and agentic risk

Overview

This is a powerful desktop-control skill with disclosed purpose, but its unverified executable install path, broad remote API trust, screenshot/file upload behavior, and plaintext token handling need review before use.

Install only if you trust the ScreenClaw service and its GitHub release source. Prefer a pinned, verified binary, rotate away from the documented default token, keep the API bound to localhost or HTTPS trusted origins, avoid remote servers unless necessary, and do not use delegated mode or desktop automation on passwords, payments, security prompts, destructive dialogs, or confidential screens without explicit review.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:76
Finding: Mutable Remote Executable Is Downloaded and Run Without Integrity Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/_common.py:246
Finding: Arbitrary Local Files Can Be Encoded and Uploaded to a Configurable Remote Server
Content: View full analysis
str: source = Path(path).expanduser() if not source.exists(): raise ValueError(f"source_image_path not found: {path}") return base64.b64encode(source.read_bytes()).decode("ascii") def prepare_remote_crop_input(endpoint: str, api_url: str, body: Dict[str, Any]) -> None: """For remote servers, send local images as base64 instead of inaccessible client paths.""" if is_local_url(api_url): return if endpoint == "crop_zoom_screenshot" and body.get("source_image_path") and not body.get("source_image_base64"): body["source_image_base64"] = path_to_base64(str(body.pop("source_image_path"))) if endpoint == "batch": for instruction in body.get("instructions", []): if instruction.get("action") != "crop_zoom_screenshot": continue params = instruction.get("params") or {} if params.get("source_image_path") and not params.get("source_image_base64"): params["source_image_base64"] = path_to_base64(str(params.pop("source_image_path"))) ``` The encoded value is subsequently sent by `scripts/screenclaw.py`, lines 77-84: ```python headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"} try: if endpoint in GET_ENDPOINTS: response = requests.get(url, headers=headers, timeout=30) else: timeout = 240 if endpoint in {"scroll_screenshot", "batch"} else 30 response = requests.post(url, headers=headers, json=body, timeout=timeout) ``` ### Technical Analysis `source_image_path` is treated as a general filesystem path. The implementation only checks that the path exists; it does not ensure that: - The file is located within a ScreenClaw screenshot ...[truncated 1846 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/screenclaw.py:69
Finding: Bearer Tokens and Desktop-Automation Data May Be Sent Over Plaintext or to Arbitrary Origins
Content: View full analysis
bool: lowered = api_url.lower() return "localhost" in lowered or "127.0.0.1" in lowered or "::1" in lowered ``` ### Technical Analysis The client accepts an arbitrary `api_url` without parsing and validating its scheme, hostname, port, user information, or final origin. It does not require HTTPS for non-loopback destinations. The bearer token is placed in the `Authorization` header. Request bodies can contain typed text, operation details, self-check summaries, screenshot material, and other desktop-automation metadata. If the destination uses HTTP, these values are not protected against network interception or modification. The substring-based `is_local_url()` check is not a reliable origin test. For example, a remote h ...[truncated 1425 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: references/self_check.md:129
Finding: Remote API Responses Can Trigger Agent Workflow Changes and Transmission of Task Context
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/config.md:18
Finding: Published Default Authentication Token Creates Predictable Credentials
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/screenclaw.py:6
Finding: Runtime Dependency Installation Is Unpinned and Lacks Integrity Verification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (45)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个完整的 Windows 桌面 RPA/视觉自动化技能，核心能力应包括截图、识别屏幕元素坐标、执行鼠标键盘操作，以及录制并复用场景模板。实际代码则是一个分析脚本：从 step.json 中读取已录制的步骤，按窗口/弹窗/子窗口等类型分组，生成摘要表和警告。它最多可视为“录制后处理/模板整理”的辅助组件，但无法单独支撑声明的主要用途。由于代码的主要行为与描述的核心自动化能力明显不符，应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is capable of broad desktop interaction—clicks, typing, dragging, handling file pickers, and controlling arbitrary third-party applications—yet the description does not present a clear safety warning or consent boundary. In context, this is especially dangerous because the skill explicitly targets software that normal APIs cannot cover, including strict anti-abuse environments, hidden UI, games, and system-level surfaces, which raises the risk of unintended destructive actions or misuse against sensitive interfaces.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill describes capabilities that require broad file, environment, and network access but does not declare any explicit tool scope or permission boundaries. For a desktop-automation skill, this is dangerous because it can lead to over-privileged execution, including reading local files, modifying config/templates, downloading binaries, and contacting external services without a clear allowlist or user-visible constraint.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation guidance is extremely broad, effectively routing many generic requests about clicking, inputting, automation, games, desktop software, and cross-window actions into a powerful desktop-control skill. Over-broad triggers increase the chance of accidental invocation in sensitive contexts, causing the agent to manipulate third-party apps or system UI when a lower-risk skill or simple textual assistance would have been more appropriate.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation exposes powerful batch desktop/window automation primitives—clicking, typing, key presses, drag/drop, and scrolling—without any guardrails, warning language, confirmation requirements, or scope restrictions. In the context of this skill, which is explicitly designed to operate arbitrary Windows applications and cross-window flows, these actions can be combined to perform destructive or sensitive operations such as sending messages, changing settings, moving files, confirming dialogs, or interacting with security-sensitive UIs at machine speed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation explicitly states that in remote scenarios the local screenshot file is converted to base64 and sent to a server, but it does not warn users that screenshots may contain sensitive on-screen data such as credentials, chats, personal information, or proprietary application content. In this skill’s context, screenshots are taken from arbitrary desktop software and security-sensitive webpages, which materially increases the privacy and data-exfiltration risk if users are unaware of the transmission boundary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file explicitly states that when delegated mode is active, click confirmation is automatically skipped. In a skill designed to control arbitrary desktop software via screenshot-derived coordinates, removing confirmation increases the chance of unintended or unsafe UI actions, including clicks on sensitive controls, security prompts, or destructive buttons if the model misreads the screen or the UI changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation explicitly states that in hijack mode, confirmation is automatically skipped for a desktop double-click action. In a skill designed to control arbitrary desktop software via screenshots and coordinates, bypassing confirmation increases the chance of unintended or unauthorized UI actions, especially against sensitive applications, dialogs, or security prompts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation explicitly describes a desktop drag capability in fixed hijack mode and notes that delegated mode can skip confirmation, yet it lacks a clear safety warning about direct UI manipulation. In this skill's context—general-purpose automation of arbitrary desktop software, including security-sensitive apps—drag actions can move files, rearrange UI state, trigger destructive operations, or interact across windows and monitors without meaningful user awareness.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language content of this markdown file is entirely in Chinese, including the description, headings, and parameter explanations, with no indication that the skill supports other languages or that Chinese-only use is required for a region-specific purpose. This creates a locale/language policy concern because the skill effectively imposes a language constraint without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation explicitly states that the tool will click to steal focus and then paste via the clipboard in a fixed hijack mode, with confirmation skipped in delegated mode. In a desktop automation skill intended to operate arbitrary Windows applications, this can overwrite the user's clipboard, send sensitive text to the wrong window, and trigger unintended actions in privileged or security-sensitive contexts without an adequate warning or consent boundary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation states the action runs in fixed hijack mode and that confirmation is automatically skipped when delegated mode is active, while also supporting system-level shortcuts such as Win and Alt+Tab. In the context of a desktop automation skill that can control arbitrary Windows software, this removes an important user-consent barrier and enables unintended or unsafe system-wide input injection, including focus switching, launching menus, or affecting privileged windows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation states that in delegated mode confirmation is automatically skipped for a desktop right-click action. In a skill explicitly designed to control arbitrary Windows software through screen coordinates, bypassing confirmation increases the chance of unintended or unauthorized UI interaction, especially because right-click context menus can expose destructive actions such as delete, run-as-admin, or security-sensitive workflow steps.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The API documentation explicitly enables full-desktop screenshot capture and transmission/return of image data, but it does not warn that the capture may include sensitive information from unrelated applications, notifications, credentials, personal data, or other monitors' visible content. In this skill's context, desktop-wide visual automation is a core capability and is intended for arbitrary software, which materially increases the risk of over-collection, privacy leakage, and accidental exfiltration to remote services or models.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The natural-language content of the skill file is entirely in Chinese, including the description and usage guidance, with no indication that language is selectable or that the skill is region-specific. Under the policy rule, forcing a specific language without user opt-in can be a locale policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation explicitly states that in delegated mode confirmation is automatically skipped for a desktop-input action. In the context of a skill designed to control arbitrary Windows applications via mouse and keyboard, this removes an important safety barrier and increases the risk of unintended or unauthorized input on the user's system.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file’s user-facing instructions are entirely in Chinese, with no indication that language selection is optional or that the skill is specifically limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file’s natural-language content, including the description, usage guidance, and troubleshooting, is entirely in Chinese. This imposes a specific language on users without any documented opt-in or indication that the skill is intentionally region-specific, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This file’s natural-language content, including the description and usage guidance, is entirely in Chinese. Under the policy rule, forcing a specific language without user opt-in or a documented justification is a locale/language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file’s user-facing description and instructions are entirely in Chinese, which imposes a specific language on users. Under the policy, language constraints should either be optional for the user or explicitly documented as a justified locale-specific limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: 文件标题和说明均以中文固定呈现，未表明这是可选语言，也未提供其他语言或用户选择机制。根据 SQP-3，若技能在自然语言层面强制特定语言/locale 且无用户 opt-in，可构成语言/地区策略违规。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation states that the API returns a local image path and may materialize base64 screenshot data to disk, but it does not warn that scrolling screenshots can capture sensitive on-screen content such as chats, documents, credentials, or regulated data across multiple viewport segments. In this skill’s context—desktop automation of arbitrary apps, including chat tools and high-friction websites—the omission increases the risk of unintended bulk data collection and local persistence without informed user awareness.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document says not to guess or use defaults, yet it publishes a concrete default localhost endpoint and bearer token. In practice, an agent or user may still use these values, enabling unauthorized control of a locally running ScreenClaw service if that service ships with the same static token or if the token is widely reused. Given this skill can drive arbitrary desktop input, compromise of the local agent-to-service channel can translate into full desktop automation abuse.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The configuration instructs saving and reusing user-provided authentication details directly in the skill file, which creates a plaintext secret persistence channel inside agent assets. Anyone with access to the skill files, logs, backups, or version control could recover the token and invoke the desktop automation service, potentially performing arbitrary clicks, keystrokes, and data entry on the user's machine.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest-style description is written as a Chinese-only requirement/description and provides no indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.