T09 · Insecure Skill Coding Practices
Error
- Location
server.py:320- Finding
Unauthenticated Desktop-Control API with Permissive Cross-Origin Access
- Content
View full analysis
- Remediation
View remediation
Security audit
Wincontrol
Security checks for vulnerabilities and agentic risk
Overview
The skill openly provides Windows screen capture and mouse/keyboard control, but its unauthenticated localhost API gives any local process desktop-control access, so it needs review before installation.
Install only on a trusted, single-user Windows session, avoid running it elevated, stop it when not actively needed, and assume any local process that can reach localhost:8767 may capture the screen or drive the mouse and keyboard. Review the unauthenticated API, wildcard CORS, unpinned dependencies, and WSL start-script behavior before use.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T07 · Tool Hijacking and Spoofing
Warning
- Location
start.sh:14- Finding
Local API Spoofing Can Cause Agents to Trust Attacker-Controlled File Paths
- Content
View full analysis
/dev/null 2>&1; then echo "✅ WinControl is already running!" echo "API: http://localhost:8767" echo "Frames: /tmp/wincontrol/" exit 0 fi ``` The documented workflow trusts the service-provided path: ```bash FILE=$(curl -s -X POST http://localhost:8767/capture | python3 -c "import sys,json; print(json.load(sys.stdin)['path'])") read "$FILE" ``` The Agent integration similarly reads the returned value without path validation: ```javascript const result = await exec("curl -s -X POST http://localhost:8767/capture"); const data = JSON.parse(result.stdout); // Path will be Windows format: C:\Users\... await read(data.path); ``` ### Technical Analysis The startup script checks only whether some service answers at `localhost:8767/ping`. It does not validate the response body, authenticate the service, confirm the server process identity, or exchange a session-specific nonce. A malicious or compromised local process can bind the port before WinControl starts and impersonate the API. The documented clients then treat the `/capture` response's `path` field as authoritative. They do not canonicalize it or require it to equal the intended `screenshot.jpg` path in the Skill directory. Consequently, a spoofed service can return a path to another file accessible to the Agent. The flagged pipeline in `SKILL.md:173` is not a `curl | bash` remote-code execution pattern. It parses JSON from a localhost endpoint. Its security issue is the unvalidated trust placed in the responding local service and its returned path. ### Attack Path 1. An attacker-controlled local proc ...[truncated 1195 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
start.sh:21- Finding
PowerShell Command Injection Through Unvalidated Environment-Derived Path Components
- Content
View full analysis
/dev/null || echo "Ubuntu") if [ "$WSL_DISTRO" = "ubuntu" ]; then WSL_DISTRO="Ubuntu" fi # Start server using PowerShell 7 with forward-slash WSL path PWSH='/mnt/c/Program Files/PowerShell/7/pwsh.exe' $PWSH -Command "python //wsl.localhost/$WSL_DISTRO/home/$USER/.openclaw/workspace/skills/wincontrol/server.py" & ``` ### Technical Analysis `WSL_DISTRO` is derived from `/etc/os-release`, while `USER` is inherited from the invoking environment. Both values are interpolated directly into a string passed to PowerShell's `-Command` option. The script does not validate either value against an allowlist and does not quote the resulting script path as a PowerShell literal. PowerShell parses the expanded string as executable command language. If an attacker can influence one of the interpolated values, PowerShell metacharacters such as semicolons, quotes, pipes, or subexpressions can alter the intended command and append attacker-selected commands. Although `/etc/os-release` is normally root-controlled, `$USER` is an environment variable and should not be treated as an authenticated identity. The unsafe construction also makes the script fragile for legitimate usernames or distro identifiers containing spaces or PowerShell-significant characters. ### Attack Path 1. An attacker gains the ability to influence the environment used to launch `start.sh`, particularly the `USER` variable, or modifies the distro identifier in an already compromised WSL environment. 2. The attacker places PowerShell syntax in the controlled value. 3. The victim executes `start.sh`. 4. Bash expands the value inside the double-quoted `-Command` argument. 5. `pwsh.exe` parses the resulting text ...[truncated 649 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:24- Finding
Unpinned Third-Party Python Dependencies Create a Mutable Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (22)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
Mouse Actions
bash # Move cursor (no click) curl -X POST http://localhost:8767/move -d '{"x": 500, "y": 300}' # Click curl -X POST http://localhost:8767/click -d '{"x": 500, "y": 300}'
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 100% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh $PWSH -Command "Get-Process python -ErrorAction SilentlyContinue | Where-Object {\$_.CommandLine -like '*wincontrol*'} | Stop-Process -Force" 2>/dev/null # Clean up frames rm -rf /tmp/wincontrol/*.jpg 2>/dev/null # Verify stopped if curl -s --max-time 1 http://localhost:8767/ping > /dev/null 2>&1; then
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh $PWSH -Command "Get-Process python -ErrorAction SilentlyContinue | Where-Object {\$_.CommandLine -like '*wincontrol*'} | Stop-Process -Force" 2>/dev/null # Clean up frames rm -rf /tmp/wincontrol/*.jpg 2>/dev/null # Verify stopped if curl -s --max-time 1 http://localhost:8767/ping > /dev/null 2>&1; then
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 100% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh $PWSH -Command "Get-Process python -ErrorAction SilentlyContinue | Where-Object {\$_.CommandLine -like '*wincontrol*'} | Stop-Process -Force" 2>/dev/null # Clean up frames rm -rf /tmp/wincontrol/*.jpg 2>/dev/null # Verify stopped if curl -s --max-time 1 http://localhost:8767/ping > /dev/null 2>&1; then
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file describes AI remote control, screenshot capture, mouse control, and keyboard control, all of which can affect user privacy and system integrity. Under the markdown-specific SQP-2 criteria, the description should include a warning or disclosure about these behaviors, but the listed entries only describe features and endpoints.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README advertises remote screenshot capture and mouse/keyboard control over HTTP but does not warn users about the serious privacy and system-integrity risks of exposing such capabilities. In the context of an AI agent skill, these features enable surveillance and full interactive control of a desktop, which materially increases the chance of misuse, unsafe deployment, or accidental exposure beyond localhost.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md python server.py # Test curl http://localhost:8767/ping # Capture with custom quality curl -X POST http://localhost:8767/capture -H "Content-Type: application/json" -d '{"quality": 60}'
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill exposes sensitive capabilities—local HTTP control of mouse, keyboard, and screenshot capture—yet the manifest declares no explicit tool scope or permissions boundary. This increases the chance that the skill is installed or invoked without operators understanding that it enables shell/network-assisted desktop control.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill advertises screenshot capture and local file storage without a strong privacy warning that screenshots may include credentials, personal data, messages, documents, and other sensitive on-screen information. Even if bound to localhost, captured images may still be read by local processes or mishandled by users and downstream tooling.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Health check curl http://localhost:8767/ping # Output: {"ok": true} # Capture a screenshot
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
text Returns: `{"ok": true, "path": ".../screenshot.jpg", "quality": 90}` Each capture overwrites `screenshot.jpg` in the skill directory. The file is automatically deleted when the server stops. **Optional quality override:** ```bash
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
text Returns: `{"ok": true, "path": ".../screenshot.jpg", "quality": 90}` Each capture overwrites `screenshot.jpg` in the skill directory. The file is automatically deleted when the server stops. **Optional quality override:** ```bash
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation provides direct examples for clicking, dragging, scrolling, and keyboard entry, including launching applications, but does not clearly warn that remote input can trigger destructive actions such as file deletion, command execution, privilege changes, or unintended submissions. For a desktop-control skill, omission of this warning materially raises misuse risk because these endpoints are inherently high impact.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Mouse Actions
bash # Move cursor (no click) curl -X POST http://localhost:8767/move -d '{"x": 500, "y": 300}' # Click curl -X POST http://localhost:8767/click -d '{"x": 500, "y": 300}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Click and Verify
bash # Click somewhere curl -X POST http://localhost:8767/click -d '{"x": 500, "y": 300}' sleep 0.5 # Capture to see result
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ### Troubleshooting **Issue**: Server starts but curl fails - Check if port 8767 is in use: `lsof -i :8767` - Kill existing process: `kill <PID>`
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md return r.json().get("path") def click(x, y): requests.post(f"{API}/click", json={"x": x, "y": y}) def enter(keys): requests.post(f"{API}/enter", json={"keys": keys})
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md requests.post(f"{API}/click", json={"x": x, "y": y}) def enter(keys): requests.post(f"{API}/enter", json={"keys": keys}) # Example workflow if __name__ == "__main__":
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The /capture endpoint captures the current desktop and writes a screenshot to disk without any authentication, authorization, consent flow, or user-visible warning. Screenshots can expose passwords, tokens, emails, chats, documents, or other sensitive on-screen data, and the skill context explicitly enables remote desktop observation, which makes accidental or unauthorized collection especially dangerous.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The HTTP API exposes mouse movement, clicks, drags, scrolling, and keyboard entry to any local process able to reach localhost:8767, with no authentication, authorization, CSRF protection, or user confirmation. In this skill's context, these endpoints provide full interactive control of the Windows desktop, enabling arbitrary command execution through GUI automation, destructive actions, data exfiltration, and stealthy abuse of an already logged-in session.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest explicitly advertises screenshot capture and remote mouse/keyboard control over HTTP, which are highly sensitive capabilities with clear privacy and system-integrity implications. Presenting these functions without any warning, consent language, authentication expectations, or safety constraints increases the risk of covert surveillance, unauthorized input injection, and destructive system actions, especially because the skill is designed for desktop remote control.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code performs safety-relevant actions: it force-kills processes at L08 and recursively deletes files at L11. While it prints a generic stopping message, it does not clearly disclose that it will forcibly terminate processes or remove JPG files from /tmp/wincontrol, and there is no confirmation prompt or explanatory comment aimed at the user.
- Content