PCClaw

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:28 AM UTC
• Version: 2.0.0

Overview

PCClaw appears to be a legitimate Windows skills pack, but it needs human review because its installer and several skills grant broad local control and sensitive data access without enough safeguards.

Install only after reviewing the remote installer or using the manual skill-copy path. Treat this as a broad Windows automation bundle: approve browser history, clipboard, screenshot/OCR, microphone, filesystem, package, UI automation, and scheduled-task actions only when you explicitly requested them. Store OAuth refresh tokens carefully, revoke them if exposed, and periodically inspect/remove PCClaw scheduled tasks and PATH changes.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:39
• Finding: Mutable Remote PowerShell Installer Is Executed Without Inspection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:39-40` **Additional Locations**: `README.md:51-52`, `web/index.html:182`, `web/index.html:487` **Vulnerability Type**: Remote payload retrieval followed by direct execution **Risk Level**: Critical ### Vulnerable Code ```powershell irm openclaw.irisgo.xyz/i | iex ``` ### Technical Analysis `irm` is an alias for `Invoke-RestMethod`, while `iex` is an alias for `Invoke-Expression`. The command retrieves a response from `openclaw.irisgo.xyz` and immediately evaluates that response as PowerShell code. The effective installer is not contained in the audited repository. Consequently, the code executed by users can change after review without any corresponding repository modification. TLS protects the network connection but does not protect against compromise of the hosting account, web server, deployment pipeline, DNS configuration, or domain ownership. No cryptographic hash, Authenticode signature, immutable version identifier, or manual review step is required before execution. ### Attack Path 1. An attacker compromises the installer domain, hosting infrastructure, deployment credentials, or DNS configuration. 2. The attacker replaces the response at `/i` with a malicious PowerShell payload. 3. A user follows the documented installation command. 4. `Invoke-RestMethod` downloads the attacker's current response. 5. `Invoke-Expression` executes it without displaying or validating it. 6. The payload operates with all privileges held by the PowerShell process and can install further persistence or steal accessible data. ### Impact Assessment Successful exploitation provides arbitrary code execution under the invoking user's security context. This can expose user files, browser data, clipboard contents, OpenClaw configuration, API credentials, and other locally accessible information. If the user runs the command from an elevated PowerShell session, the payload may obtain administrator-level con ...[truncated 268 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all `irm ... | iex` installation instructions. 2. Publish the installer as a versioned file in the source repository or as an immutable release asset. 3. Require users to download the installer separately before execution. 4. Publish a SHA-256 digest through an independently controlled, authenticated release channel and verify it before execution. 5. Authenticode-sign the installer and verify the expected publisher and signature status. 6. Fail closed if either signature or digest verification fails. 7. Allow users to inspect the downloaded script before running it. 8. Execute the installer with the minimum required privileges and elevate only narrowly scoped operations that require administrator access. 9. Pin documentation and website commands to a specific release rather than a mutable endpoint. ]]>

T06 · System Persistence

Error

• Location: skills/win-scheduler/SKILL.md:188
• Finding: Scheduler Skill Exposes Persistent Arbitrary Command Execution<![CDATA[ ## Vulnerability Details **File Location**: `skills/win-scheduler/SKILL.md:188-205` **Related Locations**: `skills/win-scheduler/SKILL.md:97-100`, `skills/win-scheduler/SKILL.md:131-134`, `skills/win-scheduler/SKILL.md:363-368` **Vulnerability Type**: Persistent execution through logon and startup scheduled tasks **Risk Level**: High ### Vulnerable Code ```powershell ## Create Logon Task Runs when the user logs in: ```powershell powershell.exe -NoProfile -Command " $action = New-ScheduledTaskAction -Execute 'PROGRAM' -Argument 'ARGUMENTS' $trigger = New-ScheduledTaskTrigger -AtLogOn $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries Register-ScheduledTask -TaskName 'TASK_NAME' -TaskPath '\PCClaw\' -Action $action -Trigger $trigger -Settings $settings -Description 'DESCRIPTION' Write-Host 'Logon task created: TASK_NAME' " ``` ## Create Startup Task Runs when the computer starts (before logon): ```powershell powershell.exe -NoProfile -Command " $action = New-ScheduledTaskAction -Execute 'PROGRAM' -Argument 'ARGUMENTS' $trigger = New-ScheduledTaskTrigger -AtStartup $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries Register-ScheduledTask -TaskName 'TASK_NAME' -TaskPath '\PCClaw\' -Action $action -Trigger $trigger -Settings $settings -Description 'DESCRIPTION' Write-Host 'Startup task created: TASK_NAME' " ``` ``` The skill additionally recommends execution-policy bypass and hidden execution: ```powershell $action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-NoProfile -ExecutionPolicy Bypass -File \"SCRIPT_PATH\"' ``` ```text - **Hidden window**: Add `-WindowStyle Hidden` to PowerShell arguments to run silently. ``` ### Technical Analysis Scheduled execution is part of the declared functionality of `win-scheduler`, so the persistence mechanism is not concealed. However, the skill provides a general-purpose persistence primitive by accepti ...[truncated 1662 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default to one-time, current-user tasks rather than logon or startup triggers. 2. Require explicit, separate user confirmation whenever a task will survive the current session. 3. Display the complete executable path, arguments, trigger, principal, task folder, and privilege level before registration. 4. Restrict task creation to the `\PCClaw\` folder and current user unless the user explicitly requests otherwise. 5. Require absolute executable and script paths and reject paths located in temporary or user-writable download directories by default. 6. Apply an allowlist for expected executables or require stronger confirmation for arbitrary programs. 7. Remove `-ExecutionPolicy Bypass` from default examples. 8. Do not recommend hidden execution as a normal workflow. 9. Do not register tasks as `SYSTEM` or with highest privileges unless the requested operation demonstrably requires it. 10. Log every task creation and provide the exact command needed to inspect and remove it. 11. Require confirmation before deleting, changing, enabling, disabling, or immediately triggering existing tasks. ]]>

T08 · Insecure Dependencies

Error

• Location: skills/win-whisper/SKILL.md:29
• Finding: Downloaded Whisper Executables Are Installed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `skills/win-whisper/SKILL.md:29-49` **Vulnerability Type**: Unverified executable dependency installation and persistent PATH modification **Risk Level**: High ### Vulnerable Code ```powershell powershell.exe -NoProfile -Command " $whisperDir = \"$env:USERPROFILE\.pcclaw\whisper\" New-Item -ItemType Directory -Force $whisperDir | Out-Null # Download whisper.cpp pre-built binary (OpenBLAS accelerated, ~16MB) $zipUrl = 'https://github.com/ggml-org/whisper.cpp/releases/download/v1.8.3/whisper-blas-bin-x64.zip' $zipPath = \"$env:TEMP\whisper-blas-bin-x64.zip\" Write-Host 'Downloading whisper-cli...' -ForegroundColor Cyan Invoke-WebRequest -Uri $zipUrl -OutFile $zipPath Expand-Archive $zipPath -DestinationPath $whisperDir -Force Remove-Item $zipPath # Binary extracts to Release/ subdirectory — add that to PATH $binDir = \"$whisperDir\Release\" $userPath = [Environment]::GetEnvironmentVariable('Path', 'User') if ($userPath -notlike \"*$binDir*\") { [Environment]::SetEnvironmentVariable('Path', \"$userPath;$binDir\", 'User') $env:Path += \";$binDir\" Write-Host 'Added to PATH.' -ForegroundColor Green } Write-Host 'Done. whisper-cli installed.' -ForegroundColor Green " ``` ### Technical Analysis The download is version-pinned and uses the declared upstream `ggml-org/whisper.cpp` GitHub release, which is safer than an unversioned or unrelated personal hosting source. Nevertheless, the archive is extracted without verifying a cryptographic digest or publisher signature. The extracted directory is then persistently added to the user's `PATH`. This causes commands such as `whisper-cli` and `whisper-stream` to resolve to binaries from that directory in later sessions. A compromised upstream release asset, GitHub account, or release process could therefore result in persistent execution of malicious binaries. The archive is also expanded directly from a temporary location without validating archive en ...[truncated 1099 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Publish the expected SHA-256 digest for each supported release asset. 2. Calculate the downloaded archive's digest with `Get-FileHash` and abort on any mismatch. 3. Verify Authenticode signatures for extracted executables when upstream provides signed binaries. 4. Obtain hashes or signatures through a release mechanism independent of the downloaded archive. 5. Extract into a new staging directory, validate expected file names and paths, and only then move approved files into the installation directory. 6. Reject archive entries that escape the intended extraction directory. 7. Avoid modifying the persistent user `PATH`; invoke `whisper-cli.exe` using its absolute path instead. 8. If PATH integration is necessary, add only a dedicated directory containing verified files and warn the user before changing the environment. 9. Preserve version metadata and provide a secure update procedure that repeats all integrity checks. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: skills/ms-todo/SKILL.md:50
• Finding: Long-Lived Microsoft Refresh Token Is Stored in Plaintext Configuration<![CDATA[ ## Vulnerability Details **File Location**: `skills/ms-todo/SKILL.md:50-65` **Related Location**: `skills/ms-todo/SKILL.md:183` **Vulnerability Type**: Plaintext storage of a long-lived OAuth refresh token **Risk Level**: Medium ### Vulnerable Code ```text Save the `refresh_token` from the response as `MS_TODO_REFRESH_TOKEN`. ### 3. Configure OpenClaw Add to `~/.openclaw/openclaw.json`: ```json5 { skills: { entries: { "ms-todo": { env: { MS_TODO_CLIENT_ID: "your-azure-app-client-id", MS_TODO_REFRESH_TOKEN: "your-refresh-token", }, }, }, }, } ``` ``` The document further states: ```text - Use `offline_access` scope to get a refresh token that works indefinitely. ``` ### Technical Analysis The setup instructions direct users to place an OAuth refresh token directly in `~/.openclaw/openclaw.json`. A refresh token carrying `Tasks.ReadWrite` and `offline_access` can be exchanged for access tokens after the original access token expires. Plaintext configuration exposes the token to any process, skill, backup system, diagnostic collector, or user that can read the configuration file. The audited project does not contain evidence that it intentionally transmits this token elsewhere; the issue is insecure local storage rather than confirmed exfiltration. ### Attack Path 1. A user authenticates and stores the refresh token in `~/.openclaw/openclaw.json`. 2. Malware, another overprivileged skill, a local user, or an exposed backup reads that file. 3. The attacker obtains the client ID and refresh token. 4. The attacker submits the refresh token to Microsoft's OAuth token endpoint. 5. Microsoft returns an access token carrying the granted task permissions. 6. The attacker reads, creates, updates, completes, or deletes the victim's Microsoft To Do data until the credential is revoked or otherwise invalidated. ### Impact Assessment The token grants delegated access within the configured Mic ...[truncated 424 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store refresh tokens in Windows Credential Manager or DPAPI-protected storage rather than plaintext JSON. 2. Keep only a credential reference or identifier in `openclaw.json`. 3. Restrict configuration and credential-store ACLs to the intended user. 4. Ensure logs, diagnostics, command output, and error messages redact access and refresh tokens. 5. Request only the minimum Microsoft Graph scopes required by the skill. 6. Clearly document how users can revoke the application's consent and invalidate tokens. 7. Support token rotation and removal during skill uninstallation. 8. Warn users not to commit, synchronize, or include the configuration file in unencrypted backups. ]]>

T08 · Insecure Dependencies

Warning

• Location: web/index.html:24
• Finding: Website Executes Unpinned Third-Party JavaScript<![CDATA[ ## Vulnerability Details **File Location**: `web/index.html:24` **Vulnerability Type**: Mutable third-party JavaScript dependency without integrity enforcement **Risk Level**: Medium ### Vulnerable Code ```html <script src="https://cdn.tailwindcss.com"></script> ``` ### Technical Analysis The website loads and executes JavaScript from a third-party CDN at runtime. The URL is not tied to an immutable version, and the tag does not include a Subresource Integrity hash. The inspected page also does not show a restrictive Content Security Policy governing script sources. A compromised CDN response or upstream distribution channel could execute arbitrary JavaScript in the website's origin. This is particularly relevant because the page displays and copies the project's PowerShell installation command. ### Attack Path 1. An attacker compromises the CDN, upstream publishing process, or dependency distribution account. 2. The CDN serves malicious JavaScript in response to the existing URL. 3. A visitor loads the PCClaw website and the browser executes the malicious script. 4. The script changes the visible or clipboard-copied installation command, redirects the visitor, or performs other origin-accessible actions. 5. The visitor executes a substituted command, potentially leading to local code execution. ### Impact Assessment The immediate impact is arbitrary JavaScript execution in the website's origin for affected visitors. The script can alter page content and installation instructions and can access non-HttpOnly origin data if any exists. Because the site promotes a PowerShell command that executes downloaded code, modification of the copied command can bridge browser compromise into operating-system command execution if the visitor pastes and runs it. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Build Tailwind CSS during the project build and self-host the resulting static stylesheet. 2. Do not use the Tailwind browser runtime in production. 3. If an external resource remains necessary, pin it to an immutable version and use Subresource Integrity with `crossorigin="anonymous"`. 4. Deploy a restrictive Content Security Policy, preferably using hashes or nonces for allowed scripts. 5. Minimize or eliminate inline JavaScript so that CSP can prohibit `unsafe-inline`. 6. Protect installation-command UI elements from runtime modification where practical and publish independently verifiable installation hashes and signatures. 7. Add automated dependency and integrity checks to the website deployment pipeline. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (86)

Credential Access

High

• Category: Privilege Escalation

Content

│   └── skills\         # PCClaw skills (after install)
└── .config\
    └── moltbook\
        └── credentials.json
```

## Uninstall

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

1. Create a project in [Google Cloud Console](https://console.cloud.google.com)
2. Enable the **Google Tasks API**
3. Create **OAuth 2.0 Client ID** (Desktop application)
4. Download `client_secret.json`, note the `client_id` and `client_secret`

### Authenticate

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

-d "grant_type=authorization_code" | jq .
```

Save the `refresh_token`. Refresh access tokens as needed:

```bash
ACCESS_TOKEN=$(curl -s -X POST https://oauth2.googleapis.com/token \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

}
```

## Getting an Access Token

Tokens expire after ~1 hour. Refresh before each session:

• Confidence: 91% confidence
• Finding: The skill explicitly guides users through minting access tokens from a stored refresh token, enabling continued delegated access to Microsoft To Do data. In context this is necessary for authentication, but from a security standpoint it materially increases credential abuse risk if the refresh token or derived access token is exposed through environment variables, shell history, process inspection, logs, or copied command output.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill description materially understates its capabilities: it claims to only read and search notes, but the body also documents creating, updating, deleting, exporting, and launching the app. This mismatch can mislead users or higher-level agents into granting trust or invoking the skill in contexts where write actions and bulk extraction were not expected.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The workflow step 'check what user was browsing' normalizes surveillance-style use of the skill without requiring consent, authorization, or a legitimate support/debugging context. Because the skill provides direct procedures to extract recent browsing activity, this workflow materially increases the likelihood of misuse against a user's private data.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is presented as a system-information and diagnostics tool, but it also includes a forceful process-termination capability. That expands it from read-only inspection into destructive system control, creating a misleading trust boundary and enabling denial-of-service or interruption of security tools, user applications, or critical processes if invoked carelessly or abusively.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Broad access to all environment variables is not justified by the stated purpose of hardware and system diagnostics. Because environment variables commonly store API keys, cloud credentials, proxy secrets, and service configuration, this functionality creates a direct confidentiality risk disproportionate to the skill's declared use case.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The process termination examples show both graceful close and force kill, including Stop-Process -Force, with no warning that this can terminate arbitrary applications and lose unsaved work. In a UI automation context, termination capabilities are powerful and legitimate, but presenting force-kill as a simple example without safety guidance materially increases the risk of destructive misuse.

Hidden Instructions

High

• Category: Prompt Injection

Content

<title>PCClaw — OpenClaw for Windows | Native Skills for Your AI Agent</title>
    <meta name="description" content="The missing Windows experience for OpenClaw. 16 skills (14 Windows-native + 2 cross-platform), one-command installer, and Moltbook integration. Get your AI agent running on Windows in 2 minutes.">

    <!-- Open Graph -->
    <meta property="og:title" content="PCClaw — OpenClaw for Windows">
    <meta property="og:description" content="14 Windows-native AI agent skills + one-command installer. The missing piece for OpenClaw on PC.">
    <meta property="og:image" content="https://openclaw.irisgo.xyz/og-image.png">

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

PCClaw brings 14 Windows-native skills to OpenClaw — screenshot, OCR, UI automation, clipboard, browser integration, task scheduling, local AI inference, file management, system diagnostics, speech (STT + TTS), notifications, and more. Plus a one-command installer.
            </p>

            <!-- Quick Install Command -->
            <div class="code-block p-5 text-left max-w-xl mx-auto mb-3">
                <button class="copy-btn" onclick="copyCommand(this)">Copy</button>
                <code class="text-green-400 text-base md:text-lg">irm openclaw.irisgo.xyz/i | iex</code>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</p>

            <div class="bg-white rounded-2xl shadow-sm overflow-hidden">
                <!-- Header -->
                <div class="ecosystem-row bg-ocean text-white px-6 py-3 text-sm font-semibold">
                    <span></span>
                    <span>macOS (built-in)</span>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</div>
    </section>

    <!-- Skills Showcase -->
    <section class="py-16 px-4 bg-white">
        <div class="max-w-5xl mx-auto">
            <h2 class="text-3xl font-bold text-ocean text-center mb-3">16 Skills, Ready to Go</h2>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</div>
    </section>

    <!-- How It Works -->
    <section class="py-16 px-4">
        <div class="max-w-4xl mx-auto">
            <h2 class="text-3xl font-bold text-ocean text-center mb-12">2 Minutes, Zero to Running</h2>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<h2 class="text-3xl font-bold text-ocean text-center mb-12">Install</h2>

            <div class="grid md:grid-cols-2 gap-8">
                <!-- Interactive -->
                <div class="bg-sand rounded-xl p-6">
                    <div class="flex items-center gap-3 mb-4">
                        <span class="text-2xl">🪟</span>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</div>
    </section>

    <!-- FAQ -->
    <section class="py-16 px-4 bg-white">
        <div class="max-w-3xl mx-auto">
            <h2 class="text-3xl font-bold text-ocean text-center mb-12">FAQ</h2>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The `win-scheduler` entry states that the skill can create, manage, trigger, export, and delete Windows scheduled tasks. Because scheduled-task changes can alter system behavior and persistence, the markdown should disclose that these operations can affect system startup or automation state.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The `win-browser` entry says the skill can read bookmarks, browsing history, downloads, and active tab titles across browser profiles. This behavior touches sensitive personal browsing data, but the markdown provides no privacy warning or disclosure about accessing that information.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This markdown file announces that the `win-files` skill can perform create/copy/move/delete operations, which can directly affect user data and system state. The description presents these capabilities as features but includes no caution, confirmation expectation, or warning about destructive actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The `win-whisper` entry includes audio recording, streaming transcription, subtitle output, and translation features. These actions can capture sensitive spoken content, yet the markdown does not warn users about privacy implications or the need to ensure consent before recording.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The `win-ui-auto` skill is described as able to click, type text, send hotkeys, move windows, and launch or quit applications. Such automation can trigger unintended actions or data loss, but the markdown provides no warning about verifying targets or reviewing automated actions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The `win-clipboard` entry states that the skill can read and write clipboard contents including text, images, and file lists. Clipboard contents often contain sensitive material, and the markdown does not disclose that using the skill may expose or overwrite private data.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The quick-start command downloads and immediately executes remote PowerShell code via 'irm ... | iex', which prevents users from reviewing the script before execution. This pattern is dangerous because any compromise of the hosting domain, TLS trust chain, or published installer content can lead to arbitrary code execution on the user's Windows machine.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The README makes a strong privacy claim that API keys 'stay on your machine' and are 'never collect[ed] or transmit[ted],' yet the documented installer performs remote account/agent registration and posts a first message to an external service. Even if the key itself is not sent, the documentation is materially incomplete and can mislead users into exposing setup metadata or consenting to network actions they did not expect.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| Skill | What it does | Dependencies |
|-------|-------------|--------------|
| [`win-notify`](skills/win-notify/SKILL.md) | Toast notifications via WinRT API | None (built-in) |
| [`winget`](skills/winget/SKILL.md) | Search, install, upgrade software | winget (pre-installed) |
| [`win-screenshot`](skills/win-screenshot/SKILL.md) | Full screen, region, or window capture | None (built-in .NET) |
| [`win-clipboard`](skills/win-clipboard/SKILL.md) | Read/write text, images, file lists | None (built-in .NET) |

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Static analysis

No suspicious patterns detected.