ClawHub
Back to skill

Security audit

mac-use

Security checks across malware telemetry and agentic risk

Overview

This looks like a legitimate local Mac automation skill, but it deserves Review because it gives an agent broad screen, mouse, keyboard, and AppleScript control across arbitrary apps with limited guardrails.

Install only if you intentionally want an agent to see your Mac screen and control your mouse and keyboard. Use a virtual environment, avoid sensitive apps and screens, do not type passwords or secrets through this tool, clear /tmp/mac_use*.png and /tmp/mac_use_elements.json after use, and require explicit human approval before actions that send, buy, delete, approve, or change account/security settings.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def activate_app(app_name):
    """Bring an app to the foreground."""
    subprocess.run(
        ["osascript", "-e", f'tell application "{app_name}" to activate'],
        capture_output=True,
        timeout=5,
Confidence
98% confidence
Finding
subprocess.run( ["osascript", "-e", f'tell application "{app_name}" to activate'], capture_output=True, timeout=5, )

subprocess module call

Medium
Category
Dangerous Code Execution
Content
else:
        mod_str = ""
    script = f'tell application "System Events" to keystroke "{key}"{mod_str}'
    r = subprocess.run(["osascript", "-e", script], capture_output=True, timeout=10)
    if r.returncode != 0:
        sys.stderr.write(f"osascript keystroke failed: {r.stderr.decode().strip()}\n")
Confidence
98% confidence
Finding
r = subprocess.run(["osascript", "-e", script], capture_output=True, timeout=10)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
f'to perform action "AXRaise" of window "{safe_title}"'
    )
    try:
        subprocess.run(["osascript", "-e", script], capture_output=True, timeout=5)
        time.sleep(0.3)
    except Exception:
        pass
Confidence
98% confidence
Finding
subprocess.run(["osascript", "-e", script], capture_output=True, timeout=5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill exposes powerful shell-based GUI automation and writes artifacts to /tmp, but it does not declare permissions corresponding to shell execution and file writes. That mismatch weakens policy enforcement and user/agent awareness, making it easier for the skill to be invoked in contexts where broad desktop control, data exposure via screenshots, or unintended actions should have been gated explicitly.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The invocation text is very broad: it applies to interacting with any Mac desktop application's GUI, which can cause the skill to trigger for many ordinary requests without clear scoping. In this context, broad triggering is risky because the skill can click, type, scroll, activate apps, and capture screenshots across arbitrary applications, increasing the chance of misuse or accidental execution in sensitive apps.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill captures full-screen content and writes screenshots and OCR-derived element data to predictable files in /tmp without explicit consent or protections. In an agent context, this can expose sensitive on-screen data from unrelated applications, and other local processes may read or tamper with those predictable temporary files.

Unvalidated Output Injection

High
Category
Output Handling
Content
def activate_app(app_name):
    """Bring an app to the foreground."""
    subprocess.run(
        ["osascript", "-e", f'tell application "{app_name}" to activate'],
        capture_output=True,
        timeout=5,
Confidence
99% confidence
Finding
subprocess.run( ["osascript", "-e", f'tell application "{app_name}" to activate'], capture_output

Unvalidated Output Injection

High
Category
Output Handling
Content
f'to perform action "AXRaise" of window "{safe_title}"'
    )
    try:
        subprocess.run(["osascript", "-e", script], capture_output=True, timeout=5)
        time.sleep(0.3)
    except Exception:
        pass
Confidence
99% confidence
Finding
subprocess.run(["osascript", "-e", script], capture_output

Unvalidated Output Injection

High
Category
Output Handling
Content
else:
        mod_str = ""
    script = f'tell application "System Events" to keystroke "{key}"{mod_str}'
    r = subprocess.run(["osascript", "-e", script], capture_output=True, timeout=10)
    if r.returncode != 0:
        sys.stderr.write(f"osascript keystroke failed: {r.stderr.decode().strip()}\n")
Confidence
99% confidence
Finding
subprocess.run(["osascript", "-e", script], capture_output

Unpinned Dependencies

Low
Category
Supply Chain
Content
pyobjc-framework-Vision>=12.0
pyautogui>=0.9
Pillow>=10.0
Confidence
91% confidence
Finding
pyobjc-framework-Vision>=12.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
pyobjc-framework-Vision>=12.0
pyautogui>=0.9
Pillow>=10.0
Confidence
94% confidence
Finding
pyautogui>=0.9

Unpinned Dependencies

Low
Category
Supply Chain
Content
pyobjc-framework-Vision>=12.0
pyautogui>=0.9
Pillow>=10.0
Confidence
96% confidence
Finding
Pillow>=10.0

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.