Security audit

Desktop automation ultra

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed desktop automation skill, but its high-impact mouse, keyboard, screen, clipboard, and macro powers have safety-control gaps that warrant careful review before installing.

Install only if you are comfortable granting the skill control over your desktop session. Use it in a dedicated profile or non-sensitive environment, avoid recording while entering secrets, do not play macros from untrusted sources, keep safe mode enabled, and treat generated macro, log, screenshot, and report files as sensitive.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: lib/automation.py:548
Finding: Macro Playback Bypasses the Central Safe-Mode Interlock
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: lib/automation.py:477
Finding: Conditional Screen Monitoring Executes Nested Actions Without Safety Validation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/record_macro.py:219
Finding: Global Macro Recorder Stores Sensitive Keystrokes and Window Titles in Plaintext
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Dependency Manifest Uses Unbounded Minimum Versions and Conflicts with Declared Pins
Content: View full analysis
=0.9.53 pygetwindow>=0.0.9 Pillow>=8.0.0 opencv-python>=4.5.0 pytesseract>=0.3.10 pyperclip>=1.8.2 ``` Conflicting exact versions are declared separately in `skill.yaml`: ```yaml requirements: - python>=3.10 - pyautogui==0.9.54 - pygetwindow==0.0.9 - Pillow==10.4.0 - opencv-python==4.10.0.84 - pyperclip==1.9.0 - pytesseract==0.3.10 - pynput==1.7.6 - openpyxl==3.1.5 - pandas==2.2.3 - cryptography==44.0.1 - mss==9.0.1 - numpy==1.26.4 ``` ### Technical Analysis The documented installation procedure runs `pip install -r requirements.txt`. That file uses minimum-version constraints without upper bounds or hashes, so installations performed at different times may receive different package versions. This is especially significant for a desktop automation Skill because imported dependencies can access the display, keyboard, clipboard, filesystem, and process environment. A compromised future release would execute with the user's permissions during installation or import. The separate exact-version list in `skill.yaml` does not make the documented pip installation reproducible. It also includes packages that are absent from `requirements.txt`, even though corresponding modules import them. This inconsistency makes it unclear which dependency set was reviewed and tested. No specific malicious package, dependency-confusion name, or known compromised source was identified. The issue is the unsafe and inconsistent dependency policy. ### Attack Path 1. A user follows the documented instruction to run `pip install -r requirements.txt`. 2. Pip resolves any available version satisfying each `>=` constraint. 3. A future compromised, malicious, or unexpectedly incompatible package release sa ...[truncated 773 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: lib/advanced_automation.py:369
Finding: Protected Macro Passwords Use a Fast Unsalted Key Derivation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: lib/advanced_automation.py:500
Finding: Generated Macro Reports Allow Stored HTML and Script Injection
Content: View full analysis
Macro Report — {os.path.basename(macro_path)} body {{ font-family: sans-serif; margin: 20px; }} table {{ border-collapse: collapse; width: 100%; }} th, td {{ border: 1px solid #ccc; padding: 8px; text-align: left; }} th {{ background: #f0f0f0; }} .success {{ color: green; }} .error {{ color: red; }}
Macro Execution Report

Macro: {macro_path}

Generated: {timestamp}

Summary

Total actions: {len(execution_log.get('actions', []))}

Status: {execution_log.get('status', 'unknown')}

Duration: {execution_log.get('elapsed', 0):.2f}s

Actions Log
""") for i, act in enumerate(execution_log.get('actions', [])): result_class = 'success' if act.get('result', {}).get('status') == 'ok' else 'error' f.write(f"
# Action Params Result
{i+1} {act.get('action')} {act.get('params')} {act.get('result')}
Remediation: View remediation

#	Action	Params	Result
{i+1}	{act.get('action')}	{act.get('params')}	{act.get('result')}

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (71)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 1)May include surrounding context.
md
# Desktop Automation Skill for OpenClaw **âš ï¸ PRIVACY WARNING**: The macro recorder captures **ALL** keyboard events (including passwords, credit card numbers, private messages) and window titles. **Never record while entering credentials.** Only use for non-sensitive workflows. Store recorded macros securely.

YARA rule 'keylogger_indicators': Keylogger functionality in scripts or source code [malware]

High

Category: YARA Match
Confidence: 99% confidence
Finding: This script implements global keyboard and mouse capture, including all keystrokes and active window titles, then saves them to disk. Even though the UI includes a privacy warning and presents itself as a macro recorder, the functionality is effectively keylogger-like and can capture credentials, payment data, and other sensitive information from unrelated applications.
Content: Scanner excerpt · scripts/record_macro.py (reported line 17)May include surrounding context.
python
words, credit card numbers, and other sensitive data. Use with extreme caution. Only record macros for non-sensitive workflows. Never record while entering credentials. """ import tkinter as tk from tkinter import filedialog, messagebox, scrolledtext, ttk import json, os, time, threading, logging, sys from datetime import datetime from pynput import mouse, keyboard from pynput.mouse import Button from pynput.keyboard import Key # ============ CONFIGURATION LOGGING ============ logging.basicConfig( level=logging.INFO, format='[%(levelname)s] %(asctime)s — %(message)s', handlers=[logging.StreamHandler(sys.stderr)] ) logger = logging.getLogger(__name__) # ============ HANDLER TKINTER POUR LOGS ============ class TkinterLogHandler(logging.Handler): """Handler qui écrit dans un widget ScrolledText de Tkinter""" def __init__(self, text_widget, max_lines=100): super().__init__() self.text_widget = text_widget self.max_lines = max_lines

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · scripts/record_macro.py (reported line 116)May include surrounding context.
python
except Exception as e: raise IOError(f"Dossier de sortie inaccessible ({output_dir}) : {e}") # Reset state self.output_path = output_path self.recording = True self.events = []

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/test_automation.py (reported line 65)May include surrounding context.
python
def test_dangerous_pattern_detection(self): """Test dangerous pattern detection.""" self.assertTrue(self.manager.contains_dangerous_pattern("rm /etc/")) self.assertFalse(self.manager.contains_dangerous_pattern("echo hello")) def test_check_action_safety(self):

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The monitor_screen parameter example hard-codes lang: "fra", which suggests the skill expects or defaults to a specific language locale in its usage guidance. The README does not present this as user-selectable in that example or justify a region-specific constraint, so it may violate the language/locale policy requirement.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 560)May include surrounding context.
}

text
### excel_write Write an array of objects (or array of arrays) to an Excel file. ```javascript

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README makes a strong safety claim that risky actions are blocked by default, while elsewhere it documents direct use of typing, clicking, key presses, macro playback, and credential-entry examples without clearly showing the gating model. If the implementation does not actually enforce safe mode exactly as described, users may trust the docs and run destructive desktop automation believing safeguards are active.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The SKILL.md states categorically that 'All actions support dry_run=true', implying a universal non-executing test mode. However, the documented action tables and examples omit dry_run for several actions such as stop_macro, set_safe_mode, and get_safety_status, which contradicts the blanket claim rather than merely being incomplete.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README example sets lang: "fra", and later the OCR action definitions repeatedly default lang="fra". This imposes a specific locale choice in the skill's natural-language interface without offering user choice or documenting a region-specific reason, which matches the locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The core action table specifies lang="fra" as the default for several OCR-related actions. Because this is a natural-language/documentation-level locale default applied broadly, it violates the policy unless users are clearly given a language choice or the French-only behavior is justified.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 97% confidence
Finding: The documentation explicitly provides a global mechanism to disable safe mode via an environment variable, undermining the skill's primary security control. In a desktop automation skill that can type, click, capture screenshots, read OCR text, manipulate the clipboard, and replay macros, disabling safety checks materially increases the risk of destructive actions, secret capture, or unsafe automation execution.
Content: Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.
export AUTOMATION_LOG_DIR=~/my_logs

Disable safe mode globally (NOT recommended)

export AUTOMATION_SAFE_MODE=false

text
---

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The screenshot action captures the full screen and writes it to disk without any explicit user confirmation, notice, or policy gating. In a desktop automation skill, this can expose sensitive on-screen information such as passwords, messages, tokens, or confidential documents, and the saved file creates a persistent artifact that may be accessed later.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The paste_from_clipboard action reads arbitrary clipboard contents and injects them into the currently active application without confirmation or destination validation. This can unintentionally disclose secrets copied by the user, such as passwords, API keys, or private text, into chat windows, terminals, or web forms, especially because active-window context may change unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: These functions take screenshots of the user's screen and extract visible text, which can include sensitive or private information. While there is internal logging, there is no confirmation prompt, user-visible notice, or comment/docstring warning about the privacy impact of capturing and analyzing on-screen content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The function signature and documentation set the OCR language default to 'fra', making French the assumed language unless the caller overrides it. This is a natural-language policy concern because it forces a locale choice by default rather than prompting for or negotiating the user's preferred language.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This monitor routine can automatically trigger actions such as click, type, scroll, drag, clipboard operations, and window activation based on screen contents. Although the behavior is central to automation, the function provides no user-facing disclosure or warning that it may take control of the UI and affect data or application state.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: When evaluating text conditions, the monitor function falls back to 'fra' if no language is provided. This propagates a forced locale assumption into automated monitoring behavior without giving the user an explicit language choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Macro playback loads events from a file and dispatches any action present in globals() without a strict allowlist. If an attacker can supply or modify a macro file, they may trigger arbitrary exported automation functions, causing unintended keyboard/mouse control, clipboard access, window activation, or other side effects on the host.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The stop manager advertises an emergency hotkey but never sets stop_requested from keyboard events and does not actually detect the configured stop_hotkey. In an automation module that can control mouse and keyboard, a nonfunctional kill switch is a real safety issue because runaway macros may continue interacting with the system without an effective user stop path.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 97% confidence
Finding: If safety.py is missing, the code disables safety enforcement entirely by setting get_safety and set_safe_mode to None and continues operating with only a warning. For a library that can capture screens, read OCR text, manipulate windows, control mouse/keyboard, and launch macro subprocesses, fail-open security is dangerous because all protective validation is silently bypassed.
Content: Scanner excerpt · lib/automation.py (reported line 27)May include surrounding context.
python
set_safe_mode = safety.set_safe_mode else: get_safety = None set_safe_mode = None logging.warning("safety.py not available — security features disabled") logger = logging.getLogger(__name__)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The screenshot function captures the entire screen and writes it to disk by default on the user's Desktop without any consent prompt, masking, or disclosure. In a desktop automation skill, screenshots can easily contain credentials, private messages, documents, or other sensitive material, so silent capture creates a meaningful privacy and data-exposure risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The function hard-codes a default OCR language of 'fra', which imposes a specific locale choice without user opt-in. This can conflict with organizational language/locale policies when the skill is used in multilingual or non-French contexts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This OCR extraction routine processes all visible screen text, optionally from the full screen, and returns structured text plus coordinates/confidence metadata without any user-facing disclosure or minimization. In an automation-agent setting, that can expose emails, secrets, financial data, health information, or internal documents at scale, making it more dangerous than ordinary app telemetry.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The OCR extraction function forces 'fra+eng' as the recognition languages, which embeds a locale/language policy directly in the implementation. There is no indication that users can choose or opt into these language settings based on their context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The function creates and saves an Excel workbook to the provided path, affecting user data on disk. It lacks a user-facing confirmation, visible disclosure, or warning in comments/docstrings that it will write or overwrite a file.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: skill.js:14

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: lib/automation.py:22

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

Macro Execution Report

Summary

Actions Log

SkillSpector

Hidden Instructions

YARA rule 'keylogger_indicators': Keylogger functionality in scripts or source code [malware]

Memory Manipulation

Tool Parameter Abuse

Natural-Language Policy Violations

Session Persistence

Intent-Code Divergence

Intent-Code Divergence

Natural-Language Policy Violations

Natural-Language Policy Violations

Unsafe Defaults

Disable safe mode globally (NOT recommended)

Missing User Warnings

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations

Missing User Warnings

Intent-Code Divergence

Unsafe Defaults

Missing User Warnings

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations

Missing User Warnings

Static analysis

Shell command execution detected (child_process).

Dynamic code execution detected.