Back to skill

Security audit

Xia Desktop Agent

Security checks across malware telemetry and agentic risk

Overview

This is a powerful desktop-control skill whose main purpose is disclosed, but it gives broad command, screenshot, messaging, file-transfer, and remote-access credential authority without enough safeguards.

Install only if you intentionally want to grant broad control over a Windows desktop. Before using it, remove or constrain shell-based app launching, add hard confirmations for ToDesk credentials, screenshots, WeChat sends, and file transfers, and treat saved screenshots and remote-access passwords as sensitive.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (20)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"code": "code",
            }
            cmd = app_map.get(app_name.lower(), app_name)
            subprocess.Popen(cmd, shell=True)
            logger.info(f"启动应用: {app_name} -> {cmd}")
            return True
        except Exception as e:
Confidence
99% confidence
Finding
subprocess.Popen(cmd, shell=True)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill advertises powerful desktop automation and references capabilities that imply shell execution and network interaction, but it does not declare permissions or clearly bound those capabilities. In an agent environment, undeclared capabilities reduce transparency and can bypass user or platform trust decisions, especially when the skill can open apps, automate messaging, and participate in remote-access workflows.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented behavior understates or misstates what the skill can do, including sending task content to a local HTTP LLM service, enumerating windows, injecting text via Win32 messages, and handling remote-access credentials. This mismatch is dangerous because users and orchestrators may grant the skill broader trust than intended, while hidden behaviors increase the risk of data leakage, UI spoofing abuse, or unauthorized control flows.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The skill manifest describes desktop automation and app launching, but open_app falls back to arbitrary input and executes it via the shell. That means a caller can run any OS command, not just launch approved desktop applications, which materially increases the attack surface and privilege of the skill.

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The module is documented as preventing dangerous operations, but both check_task() and check_plan() only log warnings and still return True for dangerous content. In a desktop automation agent that can click, type, open apps, send messages, and initiate remote-control workflows, this creates a false sense of safety and allows destructive or privilege-affecting actions to proceed unchecked.

Vague Triggers

High
Confidence
93% confidence
Finding
The activation language is overly broad, allowing the skill to trigger on generic requests for desktop control or automation. In a high-risk desktop-control context, broad triggering can cause accidental invocation of a capability that can click, type, open apps, and interact with communications tools, leading to unintended actions or abuse.

Vague Triggers

High
Confidence
97% confidence
Finding
Using common phrases like '远程连接', 'ToDesk', or '连接你' as activation examples is especially risky because they are ambiguous and can easily appear in normal conversation. Since the resulting workflow includes launching remote-access software, taking screenshots, and extracting a temporary password, accidental or manipulated activation could expose remote-control credentials.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill describes extracting and sending remote-access credentials without prominently warning that these credentials are sensitive and enable control of the machine. In context, omitting that warning makes social engineering and unsafe user expectations more likely, especially because the workflow normalizes credential capture from screenshots.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The screenshot function captures the full screen and writes the image to a persistent directory on disk automatically. In a desktop automation context this can expose sensitive on-screen data such as messages, credentials, or documents, and persistence increases the chance of later unintended disclosure.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The fallback text-entry path copies the provided text into the system clipboard and pastes it, overwriting any existing clipboard contents without warning. On a desktop agent, clipboard contents may contain passwords, tokens, or private user data, so this behavior can cause confidentiality loss or user disruption.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
Arbitrary application or command launch occurs without any explicit confirmation, warning, or limitation to trusted programs. In this skill context, silent launching can be abused to start unexpected tools, scripts, or network-capable applications, increasing risk to the host and user privacy.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
This function can send any local file to any searched WeChat contact with no confirmation, allowlist, or visibility check. In a desktop-agent skill, that creates a serious exfiltration path because prompt-driven or misrouted automation could transmit sensitive local data to the wrong recipient immediately.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
This workflow launches remote-access software, captures a screenshot containing connection details, and returns material intended to help establish a remote session, without an explicit warning or consent gate around exposing access credentials. In the context of a desktop-control skill, that is especially dangerous because it can facilitate unauthorized remote access or credential disclosure from a highly privileged endpoint.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The executor captures screenshots before steps and at completion, then returns them in the result log without any consent, minimization, or redaction. In a desktop-control skill, screenshots can contain passwords, chat contents, documents, tokens, personal data, or remote-session details, so this creates a direct sensitive-data exposure path.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The function sends the full user task text to an LLM HTTP API without any consent prompt, disclosure, or data-classification guard. In a desktop automation skill, task descriptions may contain sensitive information such as credentials, contact details, business data, or instructions involving private applications, so silent transmission creates a real privacy and data-handling risk.

Ssd 3

High
Confidence
99% confidence
Finding
The skill explicitly instructs the agent to screenshot ToDesk, OCR the dynamically generated temporary password, and send it to the user. This is a direct credential-extraction and disclosure workflow for remote access; if triggered by an attacker or through ambiguous intent, it can enable unauthorized remote control of the device.

Ssd 3

Medium
Confidence
98% confidence
Finding
The returned execution log includes full task/step descriptions plus pre-execution and final screenshots, which can expose both user-supplied secrets and sensitive on-screen information in a durable record. Because this skill automates Windows desktop actions, including WeChat messaging and remote connection workflows, the logging materially increases the chance of leaking credentials, private conversations, files, and operational details.

External Transmission

Medium
Category
Data Exfiltration
Content
}

    try:
        resp = requests.post(LLM_URL, json=payload, timeout=30)
        resp.raise_for_status()
        content = resp.json()["choices"][0]["message"]["content"]
Confidence
93% confidence
Finding
requests.post(LLM_URL, json=

Tool Parameter Abuse

High
Category
Tool Misuse
Content
"code": "code",
            }
            cmd = app_map.get(app_name.lower(), app_name)
            subprocess.Popen(cmd, shell=True)
            logger.info(f"启动应用: {app_name} -> {cmd}")
            return True
        except Exception as e:
Confidence
99% confidence
Finding
subprocess.Popen(cmd, shell=True

Tool Parameter Abuse

High
Category
Tool Misuse
Content
"code": "code",
            }
            cmd = app_map.get(app_name.lower(), app_name)
            subprocess.Popen(cmd, shell=True)
            logger.info(f"启动应用: {app_name} -> {cmd}")
            return True
        except Exception as e:
Confidence
99% confidence
Finding
Popen(cmd, shell=True

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.