desktop-automation-100per100-local

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:40 AM UTC
• Version: 2.0.1

Overview

This skill is not clearly malicious, but it needs Review because it can control the desktop, record keystrokes, capture screen and clipboard data, and its safety controls are incomplete.

Install only if you intentionally want a local agent to have broad desktop-control authority. Do not record or replay workflows involving passwords, payment data, private messages, admin prompts, terminals, or sensitive business apps; inspect macro JSON before playback; keep macros, screenshots, reports, and logs in a protected location; use a least-privileged account; and prefer pinned dependency versions in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: lib/automation.py:552

Finding

Safe Mode Can Be Bypassed Through Macro Playback

Content

View full analysis

Dict[str, Any]: for param_key, values in params.items(): if param_key in self.DANGEROUS_PATTERNS: if isinstance(values, str): for pattern in self.DANGEROUS_PATTERNS[param_key]: if pattern.lower() in values.lower(): msg = f"Dangerous pattern '{pattern}' detected in param '{param_key}': {values}" logger.warning(msg) if self.safe_mode: return { 'allowed': False, 'reason': f"Security: {msg}", ...[truncated 3543 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: lib/safety.py:44

Finding

Sensitive Text Is Persisted in Plaintext Logs

Content

View full analysis

Dict[str, Any]: """Type text.""" params = {"text": text} if not self._check_safe("type", params): return {"status": "blocked", "reason": "Safe mode active"} try: if dry_run: logger.info("[DRY RUN] type '%s' with interval %.2f", text, interval) return {"status": "ok", "dry_run": True, "text": text} with self.lock: pyautogui.typewrite(text, interval=interval) logger.info("Typed: %s", text) ``` ### Technical Analysis The configured dangerous patterns explicitly include terms such as `password`, `secret`, and `token`. If submitted text contains one of these terms, the safety validator writes the entire value to the warning log before rejecting it. The same value is also included in the returned error reason. The alternate action implementation logs complete text both during dry-run a ...[truncated 1587 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: lib/advanced_automation.py:501

Finding

Macro Report Generation Allows Stored HTML and Script Injection

Content

View full analysis

Macro Report — {os.path.basename(macro_path)} body {{ font-family: sans-serif; margin: 20px; }} table {{ border-collapse: collapse; width: 100%; }} th, td {{ border: 1px solid #ccc; padding: 8px; text-align: left; }} th {{ background: #f0f0f0; }} .success {{ color: green; }} .error {{ color: red; }}

Macro Execution Report

Macro: {macro_path}

Generated: {timestamp}

Summary

• Total actions: {len(execution_log.get('actions', []))}
• Status: {execution_log.get('status', 'unknown')}
• Duration: {execution_log.get('elapsed', 0):.2f}s

Actions Log

""") for i, act in enumerate(execution_log.get('actions', [])): result_class = 'success' if act.get('result', {}).get('status') == 'ok' else 'error' f.write(f"\n") f.write("""

#	Action	Params	Result
{i+1}	{act.get('action')}	{act.get('params')}	{act.get('result')}

""") ``` ### Technical Analysis The macro path and execution-log fields are inserted directly into HTML without context-aware escaping. Values containing HTML elements, event-handler attributes, or script markup are therefore interpreted as document structure rather than displayed as text. Because the generated file is persistent, this is a stored injection vulnerability. The payload executes when a user opens the ...[truncated 1265 chars]

Remediation

View remediation

` elements as text. 4. Apply escaping to the macro basename, full path, status, action name, parameters, and results. 5. Add a restrictive Content Security Policy, for example one that blocks scripts and external resources. 6. Avoid inline JavaScript and inline event handlers entirely. 7. Consider generating a plain-text, JSON-only, or Markdown report when active HTML is unnecessary. 8. Add regression tests containing `

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded Dependency Constraints Allow Unreviewed Future Packages

Content

View full analysis

=0.9.53 pygetwindow>=0.0.9 Pillow>=8.0.0 opencv-python>=4.5.0 pytesseract>=0.3.10 pyperclip>=1.8.2 ``` The documented installation command resolves those mutable constraints from the configured package index: ```bash pip install -r requirements.txt ``` The dependency declarations are also inconsistent. `skill.yaml` declares exact versions and additional runtime packages that are absent from `requirements.txt`: ```yaml requirements: - python>=3.10 - pyautogui==0.9.54 - pygetwindow==0.0.9 - Pillow==10.4.0 - opencv-python==4.10.0.84 - pyperclip==1.9.0 - pytesseract==0.3.10 - pynput==1.7.6 - openpyxl==3.1.5 - pandas==2.2.3 - cryptography==44.0.1 - mss==9.0.1 - numpy==1.26.4 ``` ### Technical Analysis Lower-bound-only constraints make installation results dependent on the time, package index, resolver state, and transitive dependency graph at installation. A future release is accepted automatically without being reviewed as part of this Skill. Python packages can execute code during installation and are later imported with the privileges of the Skill process. Consequently, compromise of a dependency release or package-index resolution can introduce code not present during the audit. The mismatch between `requirements.txt` and `skill.yaml` further undermines reproducibility. Users following the documented `pip install -r requirements.txt` process may receive a materially different environment from the one represented by the metadata, and some advanced features depend on undeclared packages in that file. No currently listed package was proven malicious during this static a ...[truncated 1050 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (69)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 1)May include surrounding context.

md

# Desktop Automation Skill for OpenClaw

**⚠️  PRIVACY WARNING**: The macro recorder captures **ALL** keyboard events (including passwords, credit card numbers, private messages) and window titles. **Never record while entering credentials.** Only use for non-sensitive workflows. Store recorded macros securely.

YARA rule 'keylogger_indicators': Keylogger functionality in scripts or source code [malware]

High

• Category: YARA Match
• Confidence: 99% confidence

Finding

This script implements global keyboard capture via pynput and persists captured keystrokes to disk, which is keylogger-like behavior even if presented as a macro recorder. In this skill context, it is especially dangerous because it records all keystrokes system-wide, including passwords and other secrets, and also correlates them with window titles, increasing the sensitivity of the collected data.

Content

Scanner excerpt · scripts/record_macro.py (reported line 17)May include surrounding context.

python

words, credit card numbers, and other sensitive data. Use with extreme caution.
Only record macros for non-sensitive workflows. Never record while entering credentials.
"""
import tkinter as tk
from tkinter import filedialog, messagebox, scrolledtext, ttk
import json, os, time, threading, logging, sys
from datetime import datetime
from pynput import mouse, keyboard
from pynput.mouse import Button
from pynput.keyboard import Key

# ============ CONFIGURATION LOGGING ============
logging.basicConfig(
    level=logging.INFO,
    format='[%(levelname)s] %(asctime)s — %(message)s',
    handlers=[logging.StreamHandler(sys.stderr)]
)
logger = logging.getLogger(__name__)

# ============ HANDLER TKINTER POUR LOGS ============
class TkinterLogHandler(logging.Handler):
    """Handler qui écrit dans un widget ScrolledText de Tkinter"""
    def __init__(self, text_widget, max_lines=100):
        super().__init__()
        self.text_widget = text_widget
        self.max_lines = max_lines

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/record_macro.py (reported line 116)May include surrounding context.

python

except Exception as e:
            raise IOError(f"Dossier de sortie inaccessible ({output_dir}) : {e}")

        # Reset state
        self.output_path = output_path
        self.recording = True
        self.events = []

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/test_automation.py (reported line 65)May include surrounding context.

python

def test_dangerous_pattern_detection(self):
        """Test dangerous pattern detection."""
        self.assertTrue(self.manager.contains_dangerous_pattern("rm /etc/"))
        self.assertFalse(self.manager.contains_dangerous_pattern("echo hello"))
    
    def test_check_action_safety(self):

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation includes an example that types email and password values into detected fields, despite earlier privacy warnings about keyboard capture and sensitive input. Providing copyable credential-automation examples normalizes unsafe handling of secrets and can lead users or agents to hardcode passwords into macros, logs, or recorded workflows.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 560)May include surrounding context.

}

text

### excel_write
Write an array of objects (or array of arrays) to an Excel file.

```javascript

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README asserts that safe mode blocks risky actions like typing, clicking, and key presses by default, while elsewhere documenting those same actions as normal capabilities and showing direct usage examples. This can mislead users or downstream agents into assuming harmful actions are prevented when they may still be invoked or when enforcement details are unclear, increasing the chance of unintended desktop interaction or credential entry.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented OCR-related actions hard-code lang="fra" as the default for multiple commands. This imposes a specific locale/language behavior on users without presenting a choice or documenting a region-specific reason, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

This skill performs powerful desktop automation including keyboard capture, input injection, screenshots, clipboard access, OCR, and macro replay. Documenting a global environment variable that disables safe mode materially lowers protections and can enable destructive or stealthy automation, especially because the skill already warns it can capture sensitive input and interact with arbitrary desktop state.

Content

Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

export AUTOMATION_LOG_DIR=~/my_logs

Disable safe mode globally (NOT recommended)

export AUTOMATION_SAFE_MODE=false

text

---

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module advertises safety, but its protections are weak and optional: safe mode can be disabled at runtime, and the remaining checks only look for a few dangerous substrings in string parameters. The class still exposes broad desktop-control primitives such as clicking, typing, dragging, window activation, screenshot capture, and clipboard interaction, which can be abused to manipulate sensitive applications or exfiltrate data even when the simplistic checks do not trigger.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The screenshot function captures the entire screen and writes it to disk without any user-facing warning, confirmation, or scoping controls. In a desktop automation context, this can expose secrets visible on screen such as passwords, tokens, messages, financial data, or internal documents, and storing them on disk increases persistence and exfiltration risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The clipboard paste function reads clipboard contents and automatically types them into the active application without warning or target validation. Because clipboard data often contains credentials, API keys, personal data, or other secrets, this behavior can leak sensitive information into unintended windows, chats, terminals, or remote sessions with a single invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The function hard-codes a default OCR language of 'fra', which imposes a specific locale choice unless the caller overrides it. The policy requires avoiding forced language or locale behavior without explicit user choice or documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code captures the full screen and sends the image into OCR processing, which can include sensitive user or system information visible on screen. The function has no user-facing print/log warning, confirmation step, or explicit disclosure in comments/docstrings about handling potentially sensitive screen contents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

When evaluating text conditions, the monitor falls back to 'fra' if no language is provided, enforcing a locale choice implicitly. This is a natural-language policy issue because the user is not offered a language choice and no regional justification is documented.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The macro player loads action definitions from a file and executes them dynamically via globals() with no trust boundary, allowlist enforcement, confirmation step, or sandboxing. In a desktop automation context, a crafted macro can trigger arbitrary exported automation primitives such as typing, clicking, clipboard operations, or window manipulation, enabling harmful or deceptive system-wide actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The stop manager claims to provide a global emergency hotkey, but the listener never sets stop_requested and does not actually implement parsing or detection of the configured stop_hotkey. In an automation skill that can click, type, and replay macros globally, a non-functional stop mechanism can leave users unable to interrupt runaway actions, causing unintended system interaction or destructive automated input.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

If safety.py is absent, the library silently disables security controls and continues exposing powerful desktop automation actions such as clicks, typing, screenshots, clipboard access, OCR, and macro execution. In an agent skill context, failing open on missing safety enforcement materially increases the risk of unauthorized UI manipulation and sensitive data capture, because the skill remains fully operational without its intended guardrails.

Content

Scanner excerpt · lib/automation.py (reported line 27)May include surrounding context.

python

set_safe_mode = safety.set_safe_mode
    else:
        get_safety = None
        set_safe_mode = None
        logging.warning("safety.py not available — security features disabled")

logger = logging.getLogger(__name__)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The function captures the current screen and writes the image to disk, which can expose sensitive on-screen information and create a persistent artifact. Although the file has logging setup elsewhere, this operation itself provides no confirmation prompt, print/log disclosure, or inline warning describing that screen contents will be saved.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The function defaults OCR processing to 'fra', which imposes a specific language/locale choice on users rather than letting them choose or documenting a region-specific requirement. This is a natural-language locale policy concern because it silently biases behavior toward French recognition.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The function screenshots all or part of the display and extracts structured text from it, which may process sensitive personal, financial, or credential-related information visible on screen. While there is a French docstring describing OCR behavior, it does not clearly warn users about the privacy implications of collecting screen contents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Using a fixed 'fra+eng' OCR language set enforces locale assumptions that may not match the user's environment or preferences. The file does not offer opt-in selection or explain a compliance or regional reason for restricting recognition to these languages.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This function starts an external recorder script via subprocess, which can observe and capture user input events and create recorded automation artifacts. There is no confirmation prompt, visible log/print notice, or explanatory docstring/comment warning the user that recording will begin.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · lib/automation.py (reported line 543)May include surrounding context.

python

if output_path:
        args.append(output_path)
    try:
        subprocess.Popen(args)
        return {"status": "started", "message": "Macro recorder GUI launched"}
    except Exception as e:
        return {"status": "error", "message": str(e)}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This function invokes a macro player subprocess that may generate clicks, keystrokes, or other desktop actions affecting user applications and data. The code contains no inline warning, confirmation, or user-facing disclosure that a prerecorded macro will be executed on the user's desktop.

Content

No source excerpt is available for this finding.