mac-gui-control

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:31 AM UTC
• Version: 1.0.1

Overview

This macOS desktop-control skill is open about its purpose, but it needs review because it grants broad screen and input control and contains unsafe AppleScript input handling.

Review this before installing if you would grant it Screen Recording, Accessibility, or Automation permissions. Use it only for tasks you explicitly want automated, avoid feeding untrusted app names or key-combo strings to the helper, stop before public submissions or destructive actions, and prefer a pinned virtual environment instead of the documented unpinned pip command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mac_gui.py:165

Finding

AppleScript Injection Through Keyboard Combination Input

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mac_gui.py:139

Finding

AppleScript Injection Through Application Name Input

Content

View full analysis

= 4: left, top, right, bottom = vals[:4] emit({"ok": True, "app": app, "x": left, "y": top, "w": right - left, "h": bottom - top, "raw": vals[:4], "method": "application"}) r = osascript([ 'tell application "System Events"', f' tell process "{app}"', ' set p to position of front window', ' set s to size of front window', ' return (item 1 of p) & "," & (item 2 of p) & "," & (item 1 of s) & "," & (item 2 of s)', ' end tell', ``` ### Technical Analysis The required `--app` argument is inserted without escaping into two separate AppleScript constructs: ```python f'tell application "{app}" to get bounds of front window' ``` and: ```python f' tell process "{app}"' ``` An application name containing quotation marks, line breaks, or other AppleScript syntax can alter the generated program rather than being treated solely as data. The first generated script is attempted before the fallback script, so either interpolation surface may be reached. Using a subprocess argument list does not mitigate this vulnerability because the injection occurs in the AppleScript parser, not in a shell. AppleScript supports system interaction and shell-command execution through scripting additions, so successful source injection can cross from a window-bounds lookup into arbitrary local operations. ### Attack Path 1. An attacker controls or influences the ...[truncated 1166 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47

Finding

Unpinned Third-Party Package Installation in Setup Instructions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill exposes shell-based GUI control capabilities but does not declare any explicit tool scope such as permissions or allowed-tools. Because the skill can capture screenshots, inject keyboard/mouse input, and invoke AppleScript/system commands on the host desktop, an agent may over-broaden its authority and perform sensitive local actions without clear policy boundaries.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mac_gui.py (reported line 15)May include surrounding context.

python

def run(argv, *, input_text=None, timeout=15, check=False):
    return subprocess.run(
        argv,
        input=input_text,
        text=True,

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/mac_gui.py (reported line 37)May include surrounding context.

python

def have_module(name):
    try:
        __import__(name)
        return True
    except Exception:
        return False

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script captures the user's screen and writes the image to disk without any user-facing confirmation, warning, or consent gate. In a desktop-control skill, screenshots can expose sensitive data such as messages, credentials, tokens, financial information, or other on-screen secrets, making silent capture particularly dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill can generate arbitrary keyboard input and mouse actions on the user's macOS desktop with no safety interlocks, confirmation, or foreground-target validation. In the context of a GUI automation skill, this capability can trigger destructive actions, approve prompts, change settings, send messages, or interact with sensitive applications if invoked unexpectedly or on the wrong window.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code overwrites the system clipboard and immediately simulates Command+V without warning the user or restoring prior clipboard contents. That can leak or destroy clipboard data, and can also cause unintended submission of sensitive or dangerous text into whatever application currently has focus.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.