agent-desktop

• Outcome: Pass
• Latest audit: Aug 2, 2026 · 5:35 AM UTC
• Version: 0.1.22

Overview

This skill documents a powerful desktop automation CLI, but the sensitive capabilities are coherent with that purpose and are largely disclosed as user-directed actions.

Install this only if you want an agent to operate your desktop through Accessibility permissions. Grant Accessibility and Screen Recording only to trusted launchers, avoid screenshots and clipboard reads around sensitive content unless necessary, and use --no-trace or session gc when local automation traces should not be retained.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger text includes a broad catch-all phrase for essentially any desktop GUI interaction task, which can cause this high-privilege automation skill to activate in situations beyond the user's specific intent. Because the skill can click, type, read UI state, access the clipboard, and take screenshots, over-broad activation increases the chance of unintended sensitive actions or data exposure.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill includes screenshot capture capability but does not provide an explicit privacy warning that screenshots may capture sensitive on-screen data such as messages, credentials, documents, financial information, or system notifications. Given this tool's role in desktop observation, missing privacy guidance can lead to unnecessary collection, retention, or sharing of sensitive visual data.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill includes screenshot capture capability but does not provide an explicit privacy warning that screenshots may capture sensitive on-screen data such as messages, credentials, documents, financial information, or system notifications. Given this tool's role in desktop observation, missing privacy guidance can lead to unnecessary collection, retention, or sharing of sensitive visual data.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The form-filling workflow includes examples that modify System Settings fields and click a save/apply control without any explicit warning that these actions change persistent OS configuration. In a desktop-automation skill, omission of side-effect warnings increases the chance that an agent or user will execute state-changing examples in the wrong environment, causing unintended configuration changes.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: The clipboard workflow demonstrates copying and reading clipboard contents but does not warn that clipboard data may contain sensitive information such as passwords, tokens, personal data, or proprietary text. In a skill designed for desktop observation and interaction, normalizing clipboard reads without consent guidance can lead to inadvertent data exposure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The lifecycle workflow instructs the agent to close an application without warning about unsaved documents, interrupted user work, or destructive prompts. In desktop automation, closing apps can cause data loss or disruption if the target app has unsaved state or if the wrong window/application is targeted.

Session Persistence

Medium

• Category: Rogue Agent

Content

- **Strict resolution:** stale refs return `STALE_REF`; duplicate plausible targets return `AMBIGUOUS_TARGET` instead of choosing arbitrarily.
- **Actionability:** every ref-addressed action checks its applicable live visibility, stability, enabled, editability, policy, supported-action, and hit-test requirements under one bounded budget before a single dispatch. Pointer actions focus before their final geometry read, re-resolve moving endpoints, and return `TIMEOUT` with `details.kind: "actionability_timeout"` instead of sending input after the deadline.
- **Headless vs headed:** ref actions are strictly headless by default: semantic accessibility APIs only, with no focus stealing, cursor movement, or synthesized keyboard input. In headed mode, core focuses the exact ref window before dispatch; pointer actions also require a verified target point, while the adapter owns OS delivery. On macOS, `click`, `right-click`, `type`, `clear`, and `scroll` are physical-first; double/triple-click, hover, and drag are physical-only; expand/collapse and other semantic actions remain semantic. Raw `--xy` input has no window identity and never steals focus. `press` is explicit physical keyboard input; held-input commands (`key-down`, `key-up`, `mouse-down`, `mouse-up`) are reserved and fail closed in the stateless CLI.
- **Sessions and tracing:** run `session start` once per agent run to create a manifest with `trace: on` (default), then pass its returned ID with `--session` or `AGENT_DESKTOP_SESSION`. Use `session start --screenshots` when you need replay artifacts (`artifacts: full`): pre/post-action PNGs and refmap copies under the session trace directory (sensitive — treat exports like screenshots). Commands in that explicit scope record JSONL automatically to per-process segments under `~/.agent-desktop/sessions/<id>/trace/<pid>-<procTs>.jsonl` — no `--trace` on every call. Read traces back with `trace show` (bounded JSON for agents) or `trace export` (single-file HTML for hu
...[truncated 26 chars]

• Confidence: 93% confidence
• Finding: create a manifest with `trace: on` (default), then pass its returned ID with `--session` or `AGENT_DESKTOP_SESSION`. Use `session start --screenshots` when you need replay artifacts (`artifacts: full`

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.