Capture Windows Screen

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:58 AM UTC
• Version: 0.1.0

Overview

This skill does what it says, but it captures the full Windows desktop and runs an unbundled PowerShell helper with weak integrity controls.

Install only if you are comfortable with agents taking full-desktop screenshots on explicit request and with a local C:\OpenClaw\capture-screen.ps1 helper outside the reviewed package. Review and protect that helper and the staging directories, and avoid using this around secrets, private messages, tokens, or unrelated open windows.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/capture-windows-screen.sh:5

Finding

Unverified External PowerShell Helper Executed with Execution Policy Bypass

Content

View full analysis

Vulnerability Details

File Location: scripts/capture-windows-screen.sh, lines 5-17
Vulnerability Type: Execution of an external, integrity-unverified script with PowerShell policy bypass
Risk Level: High

Vulnerable Code

bash

WIN_SCRIPT='C:\OpenClaw\capture-screen.ps1'
OUT_WIN='C:\OpenClaw\latest-screen.png'

if [[ ! -x "$WIN_PS" ]]; then
  echo "PowerShell not found at: $WIN_PS" >&2
  exit 1
fi

"$WIN_PS" -NoProfile -ExecutionPolicy Bypass -File "$WIN_SCRIPT" -OutputPath "$OUT_WIN" >/dev/null

Technical Analysis

The Skill invokes C:\OpenClaw\capture-screen.ps1, a host-side script that is not included in the audited project. Consequently, its source code, ownership, permissions, and integrity cannot be verified from the Skill package.

The invocation also uses -ExecutionPolicy Bypass, disabling the applicable PowerShell execution-policy check for this process. Although execution policy is not a complete security boundary, bypassing it removes a defense that could otherwise prevent or warn about the execution of an untrusted helper.

The script verifies only that the PowerShell executable exists and is executable. It does not verify that the external helper:

• Is owned by a trusted administrator or account.
• Is not writable by untrusted users.
• Has an expected cryptographic hash or trusted signature.
• Contains only the intended screenshot functionality.

Therefore, anyone capable of modifying or replacing the external helper can cause arbitrary PowerShell commands to run when the screenshot Skill is invoked.

Attack Path

1. An attacker obtains write access to C:\OpenClaw\capture-screen.ps1 or replaces that file through another compromised process or account.
2. The attacker inserts arbitrary PowerShell commands into the helper, such as commands that read user data, execute programs, or establish network communication.
3. A user or Agent invokes `scripts/capture-wi ...[truncated 992 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle the PowerShell helper inside the reviewed Skill package where possible, so its contents are included in security review and version control.
2. Avoid -ExecutionPolicy Bypass. Use an appropriately signed script and a restrictive execution policy compatible with the deployment environment.
3. Before execution, verify the helper against a pinned SHA-256 digest or a trusted Authenticode signature.
4. Confirm that the helper and its parent directory are owned by a trusted account and are not writable by untrusted users.
5. Fail closed if integrity or ownership validation cannot be completed.
6. Run the helper under a dedicated least-privileged account with access only to the resources needed for screenshot capture.
7. Log integrity-validation failures without exposing sensitive paths or desktop content to unauthorized recipients.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/capture-windows-screen.sh:4

Finding

Unrestricted Environment-Controlled Executable, Source, and Destination Paths

Content

View full analysis

Vulnerability Details

File Location: scripts/capture-windows-screen.sh, lines 4-25
Vulnerability Type: Unsafe path overrides and symlink-prone file staging
Risk Level: Medium

Vulnerable Code

bash

WIN_PS="${WIN_PS:-/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe}"
WIN_SCRIPT='C:\OpenClaw\capture-screen.ps1'
OUT_WIN='C:\OpenClaw\latest-screen.png'
OUT_WSL="${OUT_WSL:-/mnt/c/OpenClaw/latest-screen.png}"
STAGE_DIR="${STAGE_DIR:-/home/lhs/.openclaw/workspace/tmp-media}"
STAMP="$(date +%Y%m%d-%H%M%S)"
STAGED_PATH="$STAGE_DIR/latest-screen-$STAMP.png"

if [[ ! -x "$WIN_PS" ]]; then
  echo "PowerShell not found at: $WIN_PS" >&2
  exit 1
fi

"$WIN_PS" -NoProfile -ExecutionPolicy Bypass -File "$WIN_SCRIPT" -OutputPath "$OUT_WIN" >/dev/null

if [[ ! -f "$OUT_WSL" ]]; then
  echo "Screenshot file not found at: $OUT_WSL" >&2
  exit 1
fi

mkdir -p "$STAGE_DIR"
cp "$OUT_WSL" "$STAGED_PATH"
printf '%s\n' "$STAGED_PATH"

Technical Analysis

Three security-sensitive paths can be supplied through inherited environment variables:

• WIN_PS determines the executable launched by the script.
• OUT_WSL determines the file copied and subsequently presented as a screenshot.
• STAGE_DIR determines where the copied file is written.

The implementation does not canonicalize these paths, restrict them to approved directories, validate ownership, or reject symbolic links. It also checks only whether OUT_WSL is a regular file from the shell's perspective; it does not validate PNG signatures, file size, ownership, or freshness.

If an attacker can influence the invocation environment, WIN_PS can point to an unintended executable. Because the remaining arguments are passed to that executable, the substituted program can ignore them and execute arbitrary behavior.

An attacker-controlled OUT_WSL can point to another readable regular file. That file would be copied to a `.p ...[truncated 2584 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the WIN_PS override and use a fixed, administrator-controlled executable path. If configurability is required, compare the canonical path against a strict allowlist before execution.
2. Restrict OUT_WSL to the canonical expected screenshot path under /mnt/c/OpenClaw/; reject paths that resolve outside that directory.
3. Validate the source using its PNG magic bytes and image structure rather than relying on its filename or -f.
4. Verify that the source is newly generated for the current invocation, has an expected owner, and is not a symbolic link.
5. Restrict STAGE_DIR to explicitly approved OpenClaw media directories after canonicalization.
6. Create the staging directory with restrictive permissions, such as mode 0700, and verify that it is not writable by untrusted users.
7. Create the destination atomically with exclusive creation and restrictive permissions. Use a secure random filename rather than a second-resolution timestamp.
8. Reject an existing destination and avoid copy operations that follow symbolic links.
9. Before transmitting the staged result, independently confirm that it is a valid PNG generated by the current capture operation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger description is broad enough to invoke screen capture for generic requests to 'show' or 'inspect' visible content, which can lead to collecting sensitive on-screen data beyond the user's precise intent. Because this skill captures the full Windows desktop from a cross-environment context, accidental invocation increases privacy and data-exposure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill does not warn that screenshots may capture secrets such as messages, tokens, personal data, or unrelated application content currently visible on the desktop. Without an explicit warning or confirmation step, users may unintentionally authorize collection and staging of sensitive data into workspace or outbound media paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script captures the current Windows desktop and copies the resulting image to a staged path without any in-script confirmation, notice, or enforcement of user consent. Because screenshots can contain secrets, personal data, messages, tokens, or unrelated application content, silent capture materially increases privacy and data-exfiltration risk, especially in an agent environment where the image may be returned to a requester.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.