ClawHub
Back to skill

Security audit

screen-off

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed macOS display-control utility, but users should handle force and permanent modes carefully because they can leave a Mac without a visible display.

Install only if you specifically want terminal or agent control over macOS displays. Avoid --force unless you have another display, remote access, or a known recovery path, and use --permanent only when you are sure the display state should survive reboot.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README explicitly documents commands that can disable displays, including `--force` and `--permanent`, but does not prominently warn users that they may lose visual control of the system or create a persistent blackout state. In the context of a screen-control utility using private APIs, insufficient safety warning increases the likelihood of accidental self-lockout or operational disruption.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly documents `--force` to turn off the only display and `--permanent` to persist the change across reboot, but it does not warn users about the risk of losing visible access or creating a persistent self-lockout condition. In an agent-driven or terminal-automation context, missing safety warnings materially increase the chance of accidental denial of use on the local system.

Static analysis

No suspicious patterns detected.