Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Windows desktop automation guide with sensitive capabilities disclosed and scoped to its stated purpose.
Install this only if you want an agent to help with Windows desktop automation. Treat notification, clipboard, screenshot, and UI tree output as sensitive, use headed actions only when you intend foreground interaction, and leave the cursor overlay disabled on shared same-account machines or for users sensitive to motion.
The trigger text includes a very broad condition such as 'or any Windows GUI interaction task,' which can cause this skill to activate for many unrelated requests. Over-broad invocation increases the chance that automation guidance is applied in the wrong context, potentially leading an agent to take GUI actions or prioritize this skill when a narrower, safer skill would be more appropriate.
These lines explicitly say the overlay does not collapse when the OS accessibility preference disables animations, and that callers who reduced motion for accessibility reasons still see full travel animation. That is a natural-language policy concern because it forces a locale/accessibility behavior without offering user choice or opt-in at the behavior level.
For markdown files, SQP-2 applies when behavior affecting privacy or system integrity is described without a clear warning. The section introduces a detached renderer process and control pipe at L097-L100, but the concrete risk that same-user processes can drive the overlay and display arbitrary text is only disclosed later at L120-L143, rather than as an upfront warning near the feature description.
