Screenclaw

• Outcome: Review
• Latest audit: Jun 23, 2026 · 3:40 PM UTC
• Version: 0.1.7

Overview

ScreenClaw is a real desktop automation skill, but it grants broad mouse, keyboard, screenshot, remote-transfer, install, and credential-handling authority that needs careful review before use.

Install only if you intentionally want an agent to control a Windows desktop with screenshots, mouse, keyboard, and batch actions. Use a unique token, keep the service bound to localhost where possible, avoid screens with passwords, financial data, private chats, or regulated data, verify any downloaded ScreenClaw binary yourself, and delete persisted screenshots/session data when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill directs the agent to read and write local files, access environment/config data, and download/run software from the network, yet no explicit permission model is declared. That creates a capability/intent mismatch: an orchestrator or reviewer may underestimate what the skill can do, while the skill can still touch sensitive local state and fetch untrusted binaries. In this context, the risk is elevated because the skill is designed to control arbitrary desktop software and persist reusable templates, which broadens the blast radius of undeclared file and network access.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The activation examples include generic phrases such as '帮我操作/点/输入 XX', which can match many ordinary user requests that do not warrant broad desktop automation. Overbroad triggering can cause the agent to invoke a powerful screen-control skill in contexts where a safer, narrower tool would suffice, increasing the chance of unintended clicks, data entry, or interaction with sensitive applications. Because this skill can act across arbitrary Windows apps and webpages, accidental invocation is materially more dangerous than for a narrowly scoped utility.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The skill explicitly says to prefer itself for any visible Windows desktop program even when there is no API, no dedicated skill, and the automation path is uncertain. That instruction encourages use of a highly privileged fallback as the default, bypassing safer and more deterministic integrations and normalizing operation against security-sensitive targets such as banking, social, anti-bot, emulator, or game interfaces. In context, this is especially dangerous because the skill combines screenshot interpretation with synthetic input, enabling arbitrary UI manipulation where policy enforcement and auditability are weaker.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This documentation promotes batch execution of state-changing GUI actions such as clicks, text input, key presses, and drag operations without any safety notice, confirmation guidance, or scope restrictions. In the context of a desktop automation skill designed to control arbitrary Windows applications, this increases the risk of unintended destructive actions, transaction submission, configuration changes, or misuse against sensitive software.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document describes screenshot and desktop_screenshot features but omits any warning that captures may include credentials, personal data, financial information, internal documents, notifications, or content from other applications on screen. Given this skill's purpose of operating arbitrary desktop software and cross-window workflows, screenshot collection materially increases privacy and data-exfiltration risk if used in sensitive contexts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly states that in remote scenarios the tool will automatically convert a local screenshot to base64 and send it to a server, but it does not warn about the privacy and sensitivity implications of transmitting screenshots. In this skill’s context, screenshots may contain credentials, personal messages, financial data, or other sensitive desktop content, so silent remote transfer materially increases data-exposure risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This documentation exposes a primitive that performs real desktop clicks at screen coordinates and emphasizes bypass-like behavior such as fixed hijack mode and auto-skipping confirmation in delegated mode, but it does not clearly warn about the risk of unintended system interaction. In the context of a skill designed to operate arbitrary desktop software, a mistaken or manipulated coordinate can trigger destructive actions, approve prompts, or interact with sensitive applications without sufficient user awareness.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation explicitly states that in hijack mode, confirmation is automatically skipped for a desktop double-click action. In a skill designed to control arbitrary Windows applications by screen coordinates, bypassing confirmation materially increases the risk of unintended or unauthorized UI actions, including interacting with security prompts, destructive controls, or sensitive applications without an explicit user checkpoint.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly states that in hijack mode, confirmation is automatically skipped when delegated mode is active, which removes an important human-safety checkpoint for a high-risk desktop control action. In the context of a skill designed to control arbitrary desktop software across windows and screens, silent drag operations can move files, alter UI state, trigger destructive actions, or assist unauthorized interaction without the user's explicit approval at execution time.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This is a real safety weakness because the tool performs a coordinate-based click to focus an arbitrary screen location and then pastes text via the clipboard, which can affect the wrong window, overwrite clipboard contents, or inject sensitive text into unintended applications. The risk is increased by the documented behavior that delegated mode skips confirmation automatically, reducing a last-chance safeguard in a high-fragility desktop automation context.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation explicitly states that this API is fixed to hijack mode and that confirmation is automatically skipped when delegated mode is active, while also supporting system-level shortcuts such as Win and Alt+Tab. That combination enables focus-stealing and OS-level input injection without a clear user-facing warning or consent boundary, which is especially dangerous in a desktop automation skill intended to operate arbitrary software across windows and processes.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: This API performs a real desktop right-click in fixed hijack mode, which can open privileged or destructive context-menu actions and alter system or application state. Because the documentation provides no explicit safety guidance, confirmation requirements, or scope restrictions, an agent could invoke it on the wrong target or as part of unsafe automation, increasing the risk of unintended clicks and follow-on actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This documentation describes full desktop screenshot capture, optional remote return of image data via `image_base64`, and use in automating arbitrary desktop applications, but provides no warning about exposure of sensitive on-screen information such as credentials, personal messages, tokens, financial data, or unrelated windows on the same monitor. In this skill context, the risk is elevated because the tool is explicitly designed to operate software that may bypass normal API boundaries and can capture whatever is visible on screen, making inadvertent collection and transmission of sensitive data much more likely.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The file explicitly states that in delegated mode, confirmation is automatically skipped for a real UI action that performs mouse-wheel input. In the context of a desktop automation skill designed to control arbitrary Windows software, this weakens user consent and can cause unintended actions in sensitive applications, especially because scrolling can trigger state changes, navigation, or interaction with security-relevant prompts.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The documentation explicitly supports hardware-level relative mouse movement and notes hijack/managed control modes, but it does not prominently warn that this can seize user input and interfere with active desktop sessions. In the broader skill context, which is designed to automate arbitrary Windows desktop software and game-like interfaces outside normal APIs, lack of an upfront warning increases the risk of unintended or misleading operator use.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: This API enables direct UI interaction by issuing a right-click at arbitrary screen coordinates, which can open context menus and expose state-changing actions such as delete, run-as-admin, or send operations. In a desktop automation skill like screenclaw, the risk is heightened because the tool is explicitly designed to control arbitrary software without native API safeguards, yet this file provides no user-facing warning, confirmation requirement, or boundary on potentially sensitive targets.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The API documentation states that screenshots are saved locally and may include full-window content, but it does not warn that long screenshots can capture sensitive data such as chats, documents, credentials, personal information, or internal logs. In the context of a desktop automation skill designed to operate arbitrary Windows applications, this omission increases the risk of unintentional collection, retention, and downstream exposure of sensitive on-screen data.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation exposes a concrete default authentication token in plaintext, which encourages use of shared credentials and makes accidental or unauthorized access far more likely if the service is reachable beyond the local machine. In a desktop automation skill that can simulate clicks, keystrokes, and interact with arbitrary applications, weak/default auth materially increases risk because compromise could lead to broad local control and data exposure.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This scenario automates sending a WeChat message to a searched contact or group, but it does not require an explicit confirmation step warning that content will be transmitted to an external recipient and that search/click ambiguity could send the message to the wrong person. Because the workflow relies on OCR/screenshot-based coordinate selection and dynamic search results, misidentification risk is materially higher than in API-addressed messaging flows.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The file explicitly instructs the agent to output user-facing text in Chinese regardless of the user's preferences. This can override normal user-directed language selection and create prompt-level control conflicts, which is especially problematic in an agent skill because embedded instructions are treated as untrusted content and should not dictate presentation policy. In a desktop automation skill, miscommunication caused by forced language output can increase operational risk if the user cannot accurately verify actions.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The README specifies that remotely returned images and batch outputs are automatically written to local disk under a persistent session-based directory, but it does not require an explicit user warning, consent, or retention controls. In a desktop automation skill that may capture arbitrary application windows, this can silently persist sensitive screenshots containing credentials, personal data, internal documents, or regulated information, increasing exposure beyond the immediate task.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README states that when using remote mode, a local image path supplied to crop_zoom_screenshot is automatically read, base64-encoded, and sent to the remote service, but it does not call out the privacy or data-transfer implications. Because this skill is designed for arbitrary desktop/software interaction, those images may include sensitive screen content from chat apps, financial systems, internal tools, or captchas, creating a real risk of unintended exfiltration to a remote endpoint.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The file explicitly instructs the agent to save and reuse user-provided address, token, installation path, and session identifiers, but provides no secure storage or handling requirements. In the context of a powerful RPA/desktop-control skill, persistent plaintext handling of connection details increases the chance of credential leakage, session mix-ups, and unauthorized reuse of access to the automation service.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.