Open Computer Use

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:15 AM UTC
• Version: 0.1.0

Overview

This skill clearly describes installing and using a desktop-control MCP tool, but users should understand that it grants broad local computer-control permissions.

Install only if you trust the npm package and repository, and grant Accessibility or Screen Recording permissions only when you actually need desktop automation. Review the package version and revoke OS permissions or remove MCP/plugin configuration when you no longer use it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Third-Party Package Installed Globally and Executed with Desktop-Control Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–44
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

Vulnerable Code

sh

npm i -g open-computer-use

On macOS, the installed package is subsequently executed and granted Accessibility and Screen Recording permissions:

sh

open-computer-use

It can also modify MCP or plugin configuration for multiple agent runtimes:

sh

open-computer-use install-codex-mcp

json

{
  "mcpServers": {
    "open-computer-use": {
      "command": "open-computer-use",
      "args": ["mcp"]
    }
  }
}

sh

open-computer-use install-codex-plugin
open-computer-use install-claude-mcp
open-computer-use install-gemini-mcp
open-computer-use install-opencode-mcp

Technical Analysis

The skill directs users to install the latest available version of open-computer-use globally from npm without pinning a reviewed version or requiring integrity or signature verification. A global npm installation executes package lifecycle scripts with the privileges of the invoking user and makes the resulting executable available system-wide.

The installed executable is then intended to receive macOS Accessibility and Screen Recording permissions and to operate local desktop applications. Installer subcommands can also update MCP or plugin configuration for several agent runtimes. Consequently, the trust placed in the mutable npm package is substantially greater than that of a typical isolated application dependency.

No evidence in the audited file demonstrates that the named package is currently malicious. The issue is the unsafe dependency acquisition model: a future compromised account, malicious release, registry substitution, or unexpected package update could cause reviewed instructions to install materially different code.

Attack Path

1. An attacker compromises the ...[truncated 1563 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installation command to a specific reviewed release, such as:

   sh

   npm install --global open-computer-use@<audited-version>
   

2. Publish expected package integrity hashes or signed release attestations and document how users must verify them before installation.

3. Prefer a project-local, lockfile-backed installation over a global installation where supported, reducing cross-project exposure and improving reproducibility.

4. Document all files and configuration entries changed by each MCP or plugin installer command.

5. Provide a review or dry-run mode that displays proposed configuration changes before applying them.

6. Advise users to inspect package provenance, publisher identity, release signatures, and lifecycle scripts before installation.

7. Recommend granting Accessibility and Screen Recording permissions only to a verified binary and revoking those permissions when computer-control functionality is no longer required.

8. Run the service under the least-privileged account and isolate it from sensitive files or applications wherever practical.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep