Security checks across malware telemetry and agentic risk
This appears to be a legitimate local Mac automation skill, but it needs Review because it gives an agent broad screen and input control with limited guardrails.
Install only if you intentionally want an agent to see your Mac screen and control your mouse and keyboard. Use a virtual environment, avoid sensitive screens, do not type secrets through it, delete /tmp/mac_use*.png and /tmp/mac_use_elements.json after use, and require explicit human approval before actions that send, buy, delete, approve, or change account/security settings.
def activate_app(app_name):
"""Bring an app to the foreground."""
subprocess.run(
["osascript", "-e", f'tell application "{app_name}" to activate'],
capture_output=True,
timeout=5,else:
mod_str = ""
script = f'tell application "System Events" to keystroke "{key}"{mod_str}'
r = subprocess.run(["osascript", "-e", script], capture_output=True, timeout=10)
if r.returncode != 0:
sys.stderr.write(f"osascript keystroke failed: {r.stderr.decode().strip()}\n")f'to perform action "AXRaise" of window "{safe_title}"'
)
try:
subprocess.run(["osascript", "-e", script], capture_output=True, timeout=5)
time.sleep(0.3)
except Exception:
passpyobjc-framework-Vision>=12.0 pyautogui>=0.9 Pillow>=10.0
pyobjc-framework-Vision>=12.0 pyautogui>=0.9 Pillow>=10.0
pyobjc-framework-Vision>=12.0 pyautogui>=0.9 Pillow>=10.0
63/63 vendors flagged this skill as clean.