Security audit
Security checks for vulnerabilities and agentic risk
This macOS desktop-control skill is mostly coherent, but it needs review because it combines screen, mouse, keyboard, clipboard, and AppleScript authority with real implementation flaws that can expose pasted text or allow AppleScript injection.
Review before installing. Use this only in a dedicated, low-sensitivity macOS session, avoid pasting secrets through it, clear or protect generated screenshots, and do not pass untrusted app names until the AppleScript interpolation and pasted-text logging issues are fixed.
scripts/applescript_app.py:42AppleScript Injection Through Unescaped Application Names
scripts/calibration.py:7Symlink-Unsafe Writes to a Predictable Shared Temporary Directory
scripts/keyboard.py:44Sensitive Pasted Text Is Disclosed Through Standard Output
requirements.txt:1Unpinned and Unhashed Third-Party Dependencies
The description claims a broad generic macOS desktop control tool including app and window semantics as well as screenshot, OCR, mouse, and keyboard workflows. The supplied code only implements four app-level actions: open an app or app bundle path, activate/make an app frontmost, test whether an app is running, and query the frontmost app. It does not implement screenshots, OCR, mouse input, keyboard input, or meaningful window control. This is therefore a description-behavior mismatch due to substantial overstatement of capabilities, even though the AppleScript/macOS app-control portion is partially accurate.
The declared description presents a broad macOS desktop control skill with multiple interaction modalities (AppleScript app/window semantics, screenshots, OCR, mouse, keyboard workflows). The supplied code only implements read-only window inspection for a named application process: retrieving the front window title, window count, or all window titles. It does not perform screenshots, OCR, mouse input, keyboard input, or broader desktop control actions. While the AppleScript/window-semantics portion is related, the actual code is materially narrower than the declared purpose, so the description does not accurately represent this code chunk.
The declared description describes a broad macOS desktop automation skill involving AppleScript, screenshots, OCR, and input control. The supplied code only implements image cropping on an existing image file using PIL. This is a materially different primary purpose and lacks the core declared behaviors entirely. Therefore the description does not accurately represent the code chunk.
The skill documents shell execution, file reads/writes, screenshot capture, and desktop automation, but it does not declare any explicit tool scope such as allowed-tools or permissions. That omission weakens containment and review because an agent may invoke broad local capabilities without a clear least-privilege contract, which is especially risky for a desktop-control skill with access to screen contents and input synthesis.
The skill description and feature list present AI semantic understanding as a core built-in visual targeting method, yet the documented scripts list includes locate_text_ocr.py and locate_image_opencv.py without any corresponding AI semantic locator implementation. This overstates what the skill itself appears to actually provide, making the claimed behavior broader than the documented code surface.
The skill encourages screenshot capture and OCR over arbitrary desktop content but does not explicitly warn that these operations may collect passwords, messages, tokens, financial data, or other sensitive on-screen information. In a desktop-control context, that omission is meaningful because operators may use the skill in privileged sessions and underestimate the privacy and exfiltration risk of captured images and OCR output.
The heading and surrounding text say AI semantic understanding is the default first-choice locator, but the example command under that heading invokes locate_text_ocr.py with a text string. This actively contradicts the documented distinction between AI semantic understanding and OCR fallback.
The skill defaults to clipboard-based paste for all text input but does not clearly warn that this can overwrite the user's clipboard and may paste secrets into the wrong field if focus is incorrect. In a desktop automation skill that can click and paste into arbitrary apps, this can cause unintended disclosure of sensitive text or destructive actions in the wrong context.
The code builds AppleScript source by directly interpolating the untrusted --app argument into script lines passed to osascript. An attacker can inject quotes and additional AppleScript statements, leading to arbitrary AppleScript execution, which in this macOS desktop-control context can drive apps, read UI state, trigger clicks/keystrokes, and potentially access sensitive user data via automation permissions.
def run_osascript(lines: List[str]) -> str:
proc = subprocess.run(
["osascript", *sum([["-e", line] for line in lines], [])],
check=True,
capture_output=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if args.action == 'open':
if args.path:
subprocess.run(['open', args.path], check=True)
emit(build_result('open', path=args.path, launch='open-path'), args.json_pretty)
return
if not args.app:
The code builds AppleScript source using an f-string with untrusted input (args.app) and passes it directly to osascript. Although subprocess.run is invoked without a shell, this is still an AppleScript injection issue: a crafted application name containing quotes and script fragments can break out of the string literal and execute arbitrary AppleScript commands, enabling UI automation, data access, or other desktop actions under the user's permissions.
def run_osascript(lines: List[str]) -> str:
proc = subprocess.run(
["osascript", *sum([["-e", line] for line in lines], [])],
check=True,
capture_output=True,
The script captures the entire macOS screen and writes it to a predictable file path under /tmp without any built-in notice, consent prompt, or disclosure mechanism. In a desktop-control skill, screenshots can contain sensitive data such as credentials, messages, or documents, so silent persistence of captured images increases privacy and data-exposure risk even if the feature is intended for automation.
The script can write arbitrary text to the macOS clipboard and immediately simulate Command+V without any confirmation, warning, or target validation. In a desktop-control skill, this can cause unintended data entry into whatever window has focus, including terminals, password fields, chats, or admin consoles, increasing the risk of secret leakage or destructive command execution.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def copy_to_clipboard(text: str) -> None:
subprocess.run(['pbcopy'], input=text, text=True, check=True)
def main() -> None:
The introductory text is in Chinese and explicitly reassures Chinese users, which creates a locale-specific framing without any corresponding statement that other languages/locales are equally supported or user-selectable. Under the policy, language or locale constraints should be optional, documented as justified, or offer user choice.
The feature list states the skill can "Type text" as part of keyboard control, while later guidance says text entry should not use simulated typing and instead always use clipboard paste. Those statements describe different intended behaviors for how text input is performed.
The dependency is specified with a lower bound only, which allows future unreviewed versions to be installed and makes builds non-reproducible. In a desktop-control skill with GUI automation privileges, a compromised or breaking upstream release could introduce supply-chain risk or unsafe behavior.
pyautogui>=0.9.54
Pillow>=10.0.0
opencv-python>=4.8.0
pyobjc-framework-Vision>=10.0
Pillow is unpinned and has a history of security advisories, so using only a minimum version leaves the installed version uncertain and non-reproducible. Because this skill processes screenshots/images, image-parsing dependencies are directly in the execution path, increasing exposure if a vulnerable release is resolved.
pyautogui>=0.9.54
Pillow>=10.0.0
opencv-python>=4.8.0
pyobjc-framework-Vision>=10.0
pyobjc-framework-Quartz>=10.0
Pillow has multiple known advisories, and because the requirement is not pinned, there is no assurance that installs will avoid affected versions. This is especially relevant here because the skill handles screenshots and OCR inputs, so vulnerable image-processing code would likely be exercised.
opencv-python is unpinned, so dependency resolution may select different versions over time, including releases with known flaws or regressions. Since the skill uses OCR/computer-vision workflows, OpenCV is a core attack surface and this context makes version uncertainty more relevant than in a package that never handles images.
pyautogui>=0.9.54
Pillow>=10.0.0
opencv-python>=4.8.0
pyobjc-framework-Vision>=10.0
pyobjc-framework-Quartz>=10.0
opencv-python has known security advisories, and the unpinned requirement means a vulnerable version could be installed without visibility. Because OpenCV is central to this skill’s screenshot/OCR and vision pipeline, any parser or memory-safety issue in the library is more likely to be reachable.
The Vision framework binding is not pinned to an exact version, which weakens reproducibility and allows unreviewed upstream changes into builds. While this is usually lower risk than native parsing libraries with many CVEs, it still creates supply-chain uncertainty in a privileged automation skill.
pyautogui>=0.9.54
Pillow>=10.0.0
opencv-python>=4.8.0
pyobjc-framework-Vision>=10.0
pyobjc-framework-Quartz>=10.0
The Quartz framework binding is also specified as a minimum version only, allowing future dependency drift. For a macOS desktop-control skill interacting with display/input APIs, dependency integrity matters because these libraries operate in a sensitive, high-privilege workflow.
Pillow>=10.0.0
opencv-python>=4.8.0
pyobjc-framework-Vision>=10.0
pyobjc-framework-Quartz>=10.0
The code hard-codes recognition languages to Simplified Chinese, Traditional Chinese, and US English. Under the natural-language policy rule, forcing specific languages without user opt-in or a documented region-specific justification is a locale policy concern.