PyAutoGUI Controller

• Analyzed: May 14, 2026, 6:44 AM
• Findings: 1
• Version: 1.0.1
• Hash: 8aaf11d4e6266e55b141f84bf77b283b07680a50a22d9b00fcabc53ddf3745cb
• Source: palm
• External report: View on VirusTotal

Findings (1)

The bundle provides a powerful desktop and browser automation framework using PyAutoGUI and Playwright. It contains high-risk capabilities, including the ability to execute arbitrary local binaries via os.startfile and subprocess.Popen in action/desktop_backend.py, and the ability to attach to existing browser sessions via CDP in bridges/playwright_dom_bridge.py. While these features align with the stated goal of 'advanced automation,' the lack of robust input sanitization in the NLU parser (nlu/parser.py) poses a risk of command injection if the agent is prompted with malicious input. The inclusion of security tools like 'Burp Suite' in the application mapping and the use of hardcoded local paths (C:\Users\dev\Desktop\昱昱\...) suggest a highly specialized and potentially intrusive automation environment.