ClawHub
Back to skill

Security audit

OverRec Screen

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local screen-control helper, but users should be careful with its optional repeated screenshot workflow because it can save sensitive screen contents.

Install only if you trust the OverRec CLI already on your machine. Use screenshots and monitoring deliberately: choose a specific region, set a duration or frame limit, pick the output folder intentionally, and delete saved frames that may contain private information.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill materially expands from on-demand screenshots and window management into persistent surveillance by providing an infinite watch loop that continuously captures and stores screen contents. This increases privacy and data-retention risk, especially because screenshots can include sensitive information from any visible application and the loop has no built-in limits, confirmation gate, or retention controls.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger description is broad enough to activate on common requests related to the screen or windows, which can cause the skill to run in situations where the user did not specifically intend screen capture or window manipulation. In a capability that can capture the screen and move windows, over-broad triggering raises the chance of unintended sensitive actions and unnecessary exposure of on-screen data.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The repeated screenshot workflow writes frames to disk indefinitely without an explicit warning about privacy exposure, disk growth, or the sensitivity of captured screen contents. Because screen captures may include credentials, messages, documents, or other confidential data, sustained collection without clear user notice or limits creates a significant risk of over-collection and unintended retention.

Static analysis

No suspicious patterns detected.