Security audit

Wincontrol

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it advertises, but it gives any local caller powerful screen capture and desktop-control access while the server is running.

Install only if you intentionally need local desktop automation on a trusted single-user machine. Keep the server bound to localhost, do not expose port 8767 to a network, stop it when not actively using it, and treat screenshot.jpg as sensitive because it may contain passwords, messages, or private documents.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill exposes significant capabilities—network access, process execution, desktop control, and screenshot capture—yet the metadata shown in the manifest does not declare permissions or capability boundaries. This weakens user awareness and trust controls, making it easier to deploy a highly privileged remote-control skill without explicit consent or policy review.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README advertises screenshot capture and mouse/keyboard control over an HTTP API but provides no warning about the privacy, consent, and system-compromise risks inherent in exposing remote desktop control. In the context of an AI-operated desktop control skill, this omission can normalize deployment of a highly sensitive capability without safeguards, increasing the chance of misuse or insecure installation.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation normalizes screenshot capture and keyboard/mouse control but does not prominently warn that the API can operate arbitrary applications, enter commands, alter files, or trigger destructive system actions. Because this skill is effectively a local remote-administration interface for the desktop, under-warning materially increases the chance of unsafe or unintended use.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The /capture endpoint allows any local process that can reach localhost:8767 to trigger a screenshot of the user’s desktop and save it to disk, with no authentication, authorization, consent prompt, or visibility controls. Because screenshots can contain credentials, messages, documents, and other sensitive data, this creates a real privacy and data-exposure risk even if the code’s intended purpose is remote desktop control.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The mouse and keyboard endpoints expose full desktop input injection over HTTP, allowing any local caller to move the cursor, click, drag, scroll, and type arbitrary keystrokes including shortcut combinations. In practice, a malicious local process could use this to execute commands, approve dialogs, exfiltrate data, alter system settings, or drive other applications on behalf of the user, making this equivalent to a powerful local privilege abuse and remote-control surface.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The description explicitly advertises remote desktop control and screenshot capture over HTTP but does not document any invocation limits, consent requirements, or safety boundaries. In an agent skill, this broad capability materially increases the risk of unauthorized surveillance and command execution because the interface suggests powerful actions without clear guardrails.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.