Web + Desktop Automation

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:11 AM UTC
• Version: 1.0.0

Overview

This is a disclosed browser and desktop automation skill, but it needs Review because it broadly enables login flows, file transfer, screenshots, and arbitrary GUI input without enough scoping or confirmation guidance.

Install only if you specifically need supervised browser plus desktop automation. Use an isolated virtual environment, pin and review dependencies before production use, and do not let it perform logins, uploads, form submissions, screenshots, or desktop typing/clicking unless you have clearly approved the exact action and target.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded and Unhashed Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, lines 1–4
Vulnerability Type: Insecure dependency version constraints and missing integrity verification
Risk Level: Medium

Vulnerable Code:

text

playwright>=1.50.0
pyautogui>=0.9.54
opencv-python>=4.10.0.84
pillow>=10.4.0

Technical Analysis

Every dependency uses an open-ended >= constraint. Consequently, a future installation may retrieve any newer package version rather than the version reviewed or tested by the project. The requirements also contain no package hashes, so pip cannot verify that downloaded distributions match explicitly approved artifacts.

This creates a supply-chain exposure: package repository compromise, maintainer account compromise, a malicious future release, or use of an attacker-controlled package index could cause installation of code that was never audited with this skill. Python packages may execute code during installation or when imported. This is especially significant here because the scripts directly import and invoke packages with broad capabilities:

• Playwright controls a browser and accesses web content.
• PyAutoGUI controls the keyboard, pointer, and screen.
• Pillow and OpenCV process attacker-influenced image files.

The audit found no evidence that the currently named packages or shipped scripts are malicious. The vulnerability is the non-reproducible, integrity-unverified dependency resolution policy.

Attack Path

1. An attacker compromises a dependency publisher, package repository, configured package index, or distribution channel.
2. The attacker publishes or serves a malicious version satisfying one of the open-ended constraints.
3. A user follows the documented installation process or runs pip install -r requirements.txt.
4. pip resolves the malicious or compromised release because it is newer than the stated minimum and no upper bound or exact pin pre ...[truncated 938 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace open-ended minimum constraints with exact, reviewed versions, for example:

   text

   playwright==1.50.0
   pyautogui==0.9.54
   opencv-python==4.10.0.84
   pillow==10.4.0
   

2. Generate a lock file that includes all transitive dependencies and platform-specific resolution results. Use a controlled dependency update process to regenerate and review it.
3. Require artifact hashes during installation, such as with a hash-locked requirements file and:

   bash

   pip install --require-hashes -r requirements.lock
   

4. Pin the package index to an approved HTTPS repository or an internally controlled mirror. Do not allow unexpected extra indexes or dependency links.
5. Install dependencies in an isolated virtual environment without administrator privileges.
6. Scan pinned dependencies for known vulnerabilities and review release changes before upgrades.
7. Pin and document the Playwright browser binary version alongside the Python package so browser installation is also reproducible.
8. Update references/dependencies.md to direct users to the locked, hash-verified installation command rather than unconstrained individual pip install commands.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

- See `requirements.txt` for a minimal install set

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description is broad enough to activate for many routine tasks involving websites or local applications, which can cause this powerful automation skill to be selected when a narrower, safer skill would be more appropriate. Because the skill enables browser control, form filling, downloads/uploads, and desktop GUI actions, over-invocation increases the chance of unintended high-impact actions on behalf of the user.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The activation guidance lists common activities like opening websites, reading content, clicking, logging in, downloading, uploading, and controlling desktop apps, but does not define clear boundaries for when this skill should defer to another skill or ask for confirmation. In a skill with both web and desktop automation capabilities, ambiguous applicability increases the attack surface by making it easier for unrelated or low-risk tasks to route into a highly privileged automation workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guidance explicitly encourages login flows and file upload/download actions but does not mention safeguards around credentials, sensitive data, consent, or confirmation before state-changing actions. In a browser/desktop automation skill, this omission can lead agents to handle secrets insecurely or perform unintended uploads, downloads, or submissions that affect user data or external accounts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code exposes GUI automation actions such as mouse movement, clicks, typing, hotkeys, and key presses that can alter user applications or data, but the file provides no warning, confirmation prompt, or explanatory comments about those effects. Because this is a generic automation template rather than a narrowly scoped skill with an obvious destructive purpose, users are not clearly informed that it can control their desktop and send input to arbitrary windows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The screenshot method captures on-screen content and saves it to a user-specified path, which affects privacy and performs a file write. The file contains no user-facing warning, comment, or documentation noting that screen contents may be collected and written to disk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency uses a lower-bound specifier instead of a pinned version, which makes builds non-reproducible and allows future installs to pull in different releases. In an automation skill with browser and desktop control, unexpectedly upgraded packages can introduce vulnerable or behavior-changing code into a high-privilege execution context.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

playwright>=1.50.0
pyautogui>=0.9.54
opencv-python>=4.10.0.84
pillow>=10.4.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The pyautogui dependency is unpinned, so installations may resolve to different future versions with unknown security posture. Because this skill performs desktop GUI automation, dependency drift is more concerning than in a low-privilege library, since compromised or buggy updates could affect local user interaction and system state.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

playwright>=1.50.0
pyautogui>=0.9.54
opencv-python>=4.10.0.84
pillow>=10.4.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The opencv-python package is specified with a minimum version only, so the actual installed version is not deterministic. Since image parsing libraries often have a history of memory-safety issues, leaving this package unpinned increases supply-chain and exposure risk in a skill that may process screenshots and UI images.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

playwright>=1.50.0
pyautogui>=0.9.54
opencv-python>=4.10.0.84
pillow>=10.4.0

Unverifiable Dependency: opencv-python has 16 known advisory(ies) (CVE-2017-12864 (Integer Overflow or Wraparound in OpenCV); CVE-2017-12598 (Out-of-bounds Read in OpenCV ); CVE-2019-14493 (NULL Pointer Dereference in OpenCV.) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

opencv-python has multiple known historical advisories, and because the manifest does not pin an exact version, it is impossible to verify whether installed environments will receive a patched or vulnerable release. In this skill context, OpenCV may process screenshots or external image content, which modestly increases practical risk if a vulnerable build is resolved.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The pillow dependency is not pinned to an exact release, which prevents reliable verification of what code will actually be installed. This matters in a GUI/web automation skill because image-processing libraries may handle untrusted screenshots or downloaded images, and version drift can silently reintroduce exploitable flaws.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

playwright>=1.50.0
pyautogui>=0.9.54
opencv-python>=4.10.0.84
pillow>=10.4.0

Unverifiable Dependency: pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

Pillow has known past advisories, including potentially serious image-parsing flaws, and the lack of version pinning makes the installed security state unverifiable. Given that this skill likely handles screenshots or downloaded images during automation, a vulnerable Pillow version could increase exposure to malformed image inputs.

Content

No source excerpt is available for this finding.