Security audit

pyautogui

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent desktop automation tool, but it can capture screens, type and click in other apps, use the clipboard, and delete files with safeguards that are too thin for that level of authority.

Install only if you are comfortable giving the agent desktop-control authority. Use it for explicit UI automation tasks, avoid screenshots/OCR over sensitive windows, avoid real passwords in examples or prompts, verify the active window and target coordinates before clicks or typing, avoid --click on OCR/template matches unless you have reviewed the target, and run cleanup only in directories that contain disposable generated images.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/image_finder.py:126
Finding: Predictable Temporary Screenshot Permits Symlink Attacks and Cross-Process Interference
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: references/requirements.txt:1
Finding: Unpinned and Incomplete Dependency Declaration Creates Supply-Chain Exposure
Content: View full analysis
=0.9.54 # 可选依赖 - 用于图像识别定位 # opencv-python>=4.8.0 # 可选依赖 - 提升截图质量 # pillow>=10.0.0 ``` The Skill separately instructs users to install additional mutable packages: ```bash pip install opencv-python numpy rapidocr_onnxruntime ``` ### Technical Analysis The active requirement uses an open-ended lower bound, while other runtime dependencies are commented out or only listed in documentation without version constraints. No lock file or package hashes are supplied. Consequently, installations performed at different times can resolve different package versions. A future compromised release, dependency takeover, or incompatible transitive dependency could be installed without any change to the audited Skill package. The project does not show direct use of an untrusted package index, typosquatted package, or currently known malicious dependency. The risk arises from mutable, unverified dependency resolution rather than evidence that the listed packages are malicious. ### Attack Path 1. A user follows the documented `pip install` commands or installs from `references/requirements.txt`. 2. The package resolver selects the latest versions satisfying the open-ended constraints. 3. A package or transitive dependency has been compromised, taken over, or publishes an unsafe release after this Skill was audited. 4. The unreviewed release is downloaded and installed. 5. Package installation hooks or imported runtime code execute with the privileges of the installing or running user. ### Impact Assessment Potential impact depends on the behavior of a compromised dependency and the privileges used during installation. Becau ...[truncated 564 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill advertises broad capabilities and also appears to have implementation/documentation drift, including undeclared clipboard operations and references to major features that may not actually exist. This mismatch is dangerous because reviewers and users may trust the declared scope while the skill performs additional actions or omits expected safeguards, enabling covert data handling or misleading activation and execution paths.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README advertises screenshot capture and OCR-based text extraction/location without clearly warning that these features can collect sensitive on-screen data such as passwords, messages, tokens, personal information, or confidential documents. In a UI automation skill, this omission increases the risk of accidental over-collection and storage of sensitive data, especially because screenshots and OCR output may be saved to disk for later use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README includes examples for automated clicking, typing, and form filling, including entering a password, but does not place an explicit warning adjacent to those examples that input may go to the wrong window or application if focus changes. Because this skill directly drives mouse and keyboard events on the host, misdirected automation can send secrets, trigger destructive actions, or interact with privileged interfaces unintentionally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README documents screenshot capture, OCR-based text extraction, and screen text enumeration, but does not clearly warn that these features can collect sensitive on-screen information such as passwords, personal data, tokens, chat content, or confidential documents. Because this skill is specifically designed for screen inspection and automation, the absence of privacy guidance makes accidental overcollection and unsafe handling of captured data more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README includes examples for automated message sending and form filling, including typing credentials and clicking submit, without an explicit warning that UI automation can act on the wrong window or transmit data to third-party applications. In the context of a keyboard/mouse automation skill, this increases the chance of accidental credential disclosure, unintended actions, or misuse by downstream agents that treat the examples as safe defaults.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: An overly broad activation description can cause the agent to invoke this skill in many ordinary contexts, including ones involving sensitive applications or data. Because this skill can control mouse/keyboard, capture screens, and potentially manipulate the clipboard, over-triggering increases the chance of unintended privileged actions or privacy-invasive automation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documents screenshot capture and OCR of screen text without an explicit privacy warning, despite those features being able to collect credentials, messages, tokens, personal information, or proprietary data visible on screen. In the context of a UI automation skill, this materially increases the risk of silent over-collection and misuse of sensitive information.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Broad trigger examples without constraints or negative examples make accidental activation more likely, especially for routine requests like clicking, typing, or taking screenshots. In a skill that can drive the UI and access on-screen content, accidental invocation can quickly turn into unauthorized actions or exposure of sensitive information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The cleanup commands include destructive deletion examples, including execute modes, without a prominent warning that deletion may be irreversible and scope-sensitive. In a skill that encourages automation and bulk operations, users may run cleanup in the wrong directory or with overly broad criteria and lose important files.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger section includes broad, everyday phrases such as '截图', '输入文字', '清理文件', and '自动执行重复操作', which can cause the skill to activate in ordinary conversations without strong user intent for desktop automation. In a skill that can control mouse/keyboard, take screenshots, OCR the screen, and delete files, accidental activation materially increases the chance of unintended clicks, keystrokes, screen capture, or file cleanup actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The documentation presents screenshot capture, OCR/text discovery, and auto-click capabilities as routine workflows, but the safety guidance only covers operational issues like active window selection and hotkeys, not privacy or authorization boundaries. In this context, users may be encouraged to capture sensitive on-screen data or trigger actions on the wrong application without clear warnings, consent checks, or review steps.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The auto-clean routine deletes files immediately with os.remove() once thresholds are exceeded, without a dry-run default, confirmation prompt, recycle-bin behavior, or path safety restrictions. In a UI automation skill that creates screenshots and derived images, this can cause unintended irreversible data loss if the directory or filename patterns are broader than expected, or if users invoke it against the wrong folder.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file’s docstring and all user-facing CLI/help text are written only in Chinese, which imposes a specific language on users. Under the policy, locale constraints should be optional or clearly justified as region-specific, neither of which is present here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The OCR workflow saves a full-screen screenshot to .temp_screenshot.png on disk without user-facing disclosure or strong guarantees about secure handling. Screenshots can contain secrets, messages, tokens, or personal data, and writing them to a predictable local file increases the chance of leakage, recovery after crashes, or access by other local processes/users.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Although presented as a finder utility, the script also performs direct UI actions via pyautogui.click() on located image or OCR matches. In an automation skill, that expands the trust boundary from passive screen analysis to active input injection, which can trigger unintended or unsafe actions if the match is wrong, the screen changes, or the command is invoked in a sensitive context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script can automatically click the first image match immediately when --click is supplied, with no confirmation, delay, or secondary validation. In a UI automation skill, mis-detection or adversarial screen content could cause unintended actions such as dismissing prompts, approving operations, or interacting with privileged applications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The OCR path clicks the first text match automatically without confirming that the detected text and coordinates are correct. OCR is inherently error-prone and susceptible to ambiguous or manipulated screen content, so this can result in mis-clicks on destructive or security-sensitive controls.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains user-facing documentation and runtime messages entirely in Chinese, including the module docstring and error/help text. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code captures the full screen and writes the image to a user-specified file path, which can expose sensitive on-screen data and modify the filesystem. While it prints after saving, there is no prior warning, confirmation, or docstring/comment disclosing the privacy and file-write impact of the operation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This function captures a selected screen region and saves it to disk, creating both privacy risk and a filesystem side effect. The code logs success afterward, but it does not provide any advance disclosure or warning that sensitive visible content may be recorded and stored.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest describes mouse/keyboard automation, screenshots, image utilities, locating, overlays, and cleanup, but does not mention clipboard read/write behavior. This file adds copy-to-clipboard and paste orchestration features that modify system clipboard state, which is materially different from the listed capabilities and broader than ordinary mouse/keyboard primitives.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This requirements file includes only Chinese natural-language comments such as the dependency description and install instructions. Under the stated policy, forcing a specific language without user opt-in can be a locale/language policy violation, and no alternative language or opt-in is provided here.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: Using a lower-bounded dependency specifier (pyautogui>=0.9.54) allows installation of any newer release, which can introduce unreviewed behavioral changes or a compromised upstream version through the software supply chain. In a UI automation skill that can control mouse and keyboard, a malicious or vulnerable dependency could materially increase risk because the package operates in a high-impact execution context.
Content: Scanner excerpt · references/requirements.txt (reported line 5)May include surrounding context.
text
# 安装命令: pip3 install -r requirements.txt # 核心依赖 - 跨平台键鼠控制 pyautogui>=0.9.54 # 可选依赖 - 用于图像识别定位 # opencv-python>=4.8.0

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: User-facing docstrings, help text, and CLI descriptions throughout the file are presented exclusively in Chinese. The file does not offer a language option or explain that the tool is intentionally limited to a Chinese-speaking context, which can violate language-choice policy.
Content: No source excerpt is available for this finding.