Security audit
Security checks across malware telemetry and agentic risk
This skill is a disclosed Mac desktop automation tool, but it gives an agent broad control over your screen, keyboard, clipboard, browser, files, downloads, and shell commands without enough built-in safety gates.
Install only if you intentionally want a highly privileged Mac desktop-control agent and can supervise it closely. Review every shell command, file move, download, login/form action, and message before allowing it, and avoid using it with secrets or sensitive apps unless the skill is changed to require confirmations, constrain shell/file access, handle clipboard contents safely, and clean up screenshots.
import json, sys, subprocess, os, tempfile
def run_osascript(script):
result = subprocess.run(
['osascript', '-e', script],
capture_output=True, text=True, timeout=10
)elif tool == 'type_text':
text = args.get('text', '').replace('"', '\\"')
subprocess.run(['osascript', '-e', f'set the clipboard to "{text}"'], check=True)
subprocess.run(['osascript', '-e', 'tell application "System Events" to keystroke "v" using command down'], check=True)
return {"jsonrpc": "2.0", "result": {"content": [{"type": "text", "text": f"Typed: {text[:50]}"}], "isError": False}}elif tool == 'set_clipboard':
text = args.get('text', '').replace('"', '\\"')
subprocess.run(['osascript', '-e', f'set the clipboard to "{text}"'], check=True)
return {"jsonrpc": "2.0", "result": {"content": [{"type": "text", "text": "Clipboard set"}], "isError": False}}
elif tool == 'shell':elif tool == 'shell':
cmd = args.get('command', '')
timeout = args.get('timeout', 30)
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
return {"jsonrpc": "2.0", "result": {"content": [{"type": "text", "text": result.stdout[:500]}], "isError": False}}
else:67/67 vendors flagged this skill as clean.