Security audit

Desktop Control

Security checks across malware telemetry and agentic risk

Overview

This is a real desktop automation skill, but it gives an agent broad control over the live desktop and captures sensitive screen or clipboard data with limited default safeguards.

Install only if you intentionally want an agent to control your desktop. Keep failsafe enabled, use approval mode where possible, avoid running it with passwords, private messages, financial data, or confidential documents visible, and do not allow autonomous form submissions, public posts, file changes, app launches, clipboard reads, or saved screenshots without reviewing them first.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as desktop automation, but the documented capabilities materially expand into privacy- and security-sensitive areas such as window enumeration, clipboard read/write, and examples that can launch applications via hotkeys and typed commands. That mismatch weakens informed consent and makes it easier for an agent or user to invoke powerful behaviors without clearly understanding the surveillance and execution implications.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The clipboard APIs let the skill read and overwrite arbitrary clipboard contents, which expands it beyond the stated mouse/keyboard/screen automation scope into data access and exfiltration territory. In an agent setting, clipboard contents commonly include passwords, tokens, personal data, or copied documents, so unrestricted access materially increases privacy and security risk.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Window enumeration and activation provide application discovery and focus control beyond simple pointer/keyboard/screen primitives. This enables the skill to identify what the user is running and redirect input into specific apps, increasing the risk of data harvesting, unauthorized interaction, or deceptive focus switching.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The agent launches applications by opening the OS Run dialog and typing a command derived from task input or a fallback value. Although intended for desktop automation, this creates a broad system-control primitive that can be steered to open programs outside the narrowly expected workflow, which increases the chance of unintended execution or abuse if exposed to untrusted prompts.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide explicitly states that the agent takes and saves screenshots during autonomous execution, but it provides no warning that screenshots may capture passwords, personal data, internal documents, or other sensitive on-screen content. In a desktop automation context, autonomous screen capture materially increases privacy and data-exposure risk because the agent may operate across arbitrary applications and windows.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The guide describes opening, editing, and saving files as part of autonomous task plans without warning that automation may overwrite files, save to unintended locations, or modify user data irreversibly. Because this skill controls desktop applications directly, mistakes in file operations can propagate quickly and affect real user data.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The guide promotes autonomous form filling using resume data without warning about exposure of personal information, submission to untrusted sites, or accidental disclosure into the wrong fields or browser contexts. In this skill's context, the combination of screen understanding, keyboard automation, and autonomous decision-making makes privacy leakage and unauthorized submission significantly more dangerous.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The social media automation example encourages autonomous posting but omits any warning that content may be immediately published publicly, potentially damaging reputation, leaking confidential material, or violating policy. In a desktop automation agent, mis-targeted clicks, wrong account context, or incorrect inferred actions can make unintended publication more likely than in narrowly scoped tools.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The guide documents disabling the failsafe and labels it as a faster mode without adequately explaining that this removes an important control against runaway or uncontrolled mouse/keyboard automation. Given that the agent is designed for autonomous screen-driven interaction across the desktop, disabling the failsafe can amplify mistakes into broad unintended actions, data loss, or unsafe system behavior.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The quick reference explicitly demonstrates saving screenshots to disk but does not warn that screenshots may capture sensitive on-screen information such as credentials, messages, or proprietary data. In a desktop automation skill, this increases the chance of unintended local data collection and persistence, especially because the example is presented as a simple default workflow.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The clipboard examples normalize reading from and writing to the system clipboard without warning that clipboard contents often contain passwords, tokens, personal data, or business-sensitive information. In a desktop-control skill, clipboard access is particularly sensitive because it enables easy cross-application data capture and transfer.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The reference includes examples and configuration guidance that can disable safety checks and invoke powerful shortcuts or UI actions without prominently warning about unintended system changes, destructive edits, or loss of control. Because this skill is designed for full desktop automation, seemingly simple hotkeys and unrestricted execution can trigger file operations, application switching, command launch, or bulk modifications in the wrong context.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The feature list advertises screenshot, image recognition, and clipboard operations without clear privacy warnings about capturing sensitive on-screen data or extracting secrets from the clipboard. In a desktop-control skill, these capabilities can expose passwords, tokens, personal data, and confidential documents if invoked by an agent or user without strong notice and consent.

Missing User Warnings

Low

Confidence: 76% confidence
Finding: The examples demonstrate saving screenshots to disk without warning that this creates persistent copies of potentially sensitive screen contents. While the behavior is common and likely instructional, it can still lead to unintended data exposure through local files, backups, or shared directories.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The scroll method performs live desktop input without calling the approval gate, so actions can be executed even when require_approval is enabled. Unapproved scrolling can interact with active applications, trigger unintended UI changes, or help automate navigation in sensitive contexts without user awareness.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: key_down and key_up bypass approval checks entirely, allowing the skill to hold modifier or system keys and combine them with other actions to produce powerful shortcuts or disruptive behavior. Because held keys can alter subsequent input semantics globally, this creates a stronger control primitive than ordinary single key presses.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The screenshot function can silently capture the full screen or arbitrary regions and optionally save them to disk without warning or consent. In an agent environment, screenshots may contain credentials, private messages, financial data, or other sensitive on-screen information, making covert capture a significant privacy and exfiltration risk.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: activate_window changes desktop focus without approval, which can redirect subsequent automated or user input into another application unexpectedly. While less severe than direct data capture, it facilitates deceptive automation chains and can be used to steer interaction toward sensitive apps.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Clipboard writes alter shared user state without warning, potentially replacing important copied data or staging malicious content for later paste into another application. In desktop automation, this can be abused to manipulate workflows, inject commands, or cause accidental disclosure when users paste unexpected content.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The task executor automatically captures screenshots before and after each step, which can collect emails, passwords, documents, chats, or other sensitive on-screen content without a just-in-time warning or consent boundary. In an autonomous desktop agent, persistent screen capture materially expands privacy exposure because the user may not realize all UI states are being recorded.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The screenshot step writes captured screen content to disk using a default filename, creating local persistence of potentially sensitive information without warning. Stored screenshots can remain accessible after task completion, be backed up or synced elsewhere, and expose private material beyond the immediate automation session.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This code performs system control actions by opening the Run dialog, typing commands, and pressing Enter, but does not present a clear safety warning or confirmation at the point of action. Because synthetic keyboard input can affect the host system broadly, users may be exposed to unintended launches or interactions if the task is ambiguous, manipulated, or triggered in the wrong context.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.