Web + Desktop Automation

• Outcome: Pass
• Latest audit: May 28, 2026 · 11:34 AM UTC
• Version: 1.0.0

Overview

This is a disclosed browser and desktop automation helper, but it gives an agent powerful controls that users should apply only to specific tasks.

Install only if you want agents to control browsers and desktop apps. Keep tasks narrowly specified, review any dependency versions in your environment, and require explicit confirmation before logins, submissions, uploads, downloads, purchases, deletions, account changes, or edits to important local files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill is triggered by very broad language covering browser automation, scraping, form filling, clicking, downloads/uploads, and desktop GUI control, without clear boundaries or consent constraints. That increases the chance the agent will invoke this skill for sensitive workflows and perform high-impact actions on websites or the local system when a narrower, safer skill or explicit confirmation should have been required.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly supports login, file upload/download, and desktop file operations but does not warn about privacy, credential handling, local file exposure, or irreversible system changes. In a web-plus-desktop automation context, this omission is more dangerous because the skill can move data between browser sessions and local applications, enabling accidental disclosure, unauthorized submission, or manipulation of sensitive files.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.50.0
pyautogui>=0.9.54
opencv-python>=4.10.0.84
pillow>=10.4.0

• Confidence: 96% confidence
• Finding: The dependency is specified with a lower-bound version only, which allows newer unreviewed releases to be installed. This weakens build reproducibility and can introduce vulnerable or malicious upstream versions into a browser/desktop automation skill that has broad interaction capabilities.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.50.0
pyautogui>=0.9.54
opencv-python>=4.10.0.84
pillow>=10.4.0

• Confidence: 96% confidence
• Finding: Using an unpinned pyautogui version permits installation of any later release, making the environment non-reproducible and increasing supply-chain risk. In a desktop automation context, unexpected package changes are more sensitive because the library can control mouse and keyboard input on the host.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.50.0
pyautogui>=0.9.54
opencv-python>=4.10.0.84
pillow>=10.4.0

• Confidence: 98% confidence
• Finding: The opencv-python dependency is unpinned, so package resolution may pull in newer versions that have not been security-reviewed for this skill. Because OpenCV processes image data and is often exposed to untrusted inputs in automation workflows, version drift increases the chance of introducing exploitable parsing flaws.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.50.0
pyautogui>=0.9.54
opencv-python>=4.10.0.84
pillow>=10.4.0

• Confidence: 99% confidence
• Finding: Pillow is declared with a minimum version only, allowing unvetted future releases to be installed. This is especially risky here because image handling libraries frequently parse untrusted data and Pillow has a history of severe vulnerabilities including code execution and denial-of-service issues.

Known Vulnerable Dependency: opencv-python — 10 advisory(ies): CVE-2017-12864 (Integer Overflow or Wraparound in OpenCV); CVE-2017-12598 (Out-of-bounds Read in OpenCV ); CVE-2019-14493 (NULL Pointer Dereference in OpenCV.) +7 more

High

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: The file includes opencv-python and the analyzer reports multiple known advisories affecting that package family. In this skill, OpenCV is likely used to inspect screenshots or other image content, so if untrusted image data is processed, historical memory-safety and parsing issues could lead to crashes, denial of service, or potentially code execution depending on the specific vulnerable version and exploit path.

Known Vulnerable Dependency: pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: Pillow is present and the analyzer associates it with numerous published vulnerabilities, including severe issues such as arbitrary code execution and resource-consumption flaws. In a web/desktop automation skill that may capture, load, transform, or analyze screenshots and downloaded images, processing attacker-controlled image files materially increases the risk and could let crafted content compromise the host or exhaust resources.

Static analysis

No suspicious patterns detected.