desktop mouse

ReviewAudited by ClawScan on May 1, 2026.

Overview

This skill is a narrowly scoped local mouse-control helper, but users should be aware it can move and click on the active desktop.

This appears safe for its stated purpose if you are comfortable letting the agent move and click your local mouse. Before installing, verify the local `molt-mouse` command is the reviewed wrapper and remember that clicks or drags can affect whichever application is currently active.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If invoked with the wrong coordinates or at the wrong time, the agent could click or move over unintended UI elements.

Why it was flagged

The skill intentionally gives the agent a host-exec path to issue local mouse commands. This is purpose-aligned and bounded to the molt-mouse wrapper, but mouse clicks can affect the active desktop.

Skill content

Use the exec tool with host=gateway. ONLY run commands that start with: `molt-mouse ...`

Recommendation

Install only if you want the agent to control the local pointer, and prefer explicit coordinates/actions when asking it to click.

Low

#ASI02: Tool Misuse and Exploitation

What this means

A user reviewing only SKILL.md may not notice that the helper can also perform holds and drags.

Why it was flagged

The wrapper supports hold and drag operations beyond the shorter Supported list in SKILL.md. These are still mouse-control functions, but the executable's practical scope is slightly broader than the runtime summary.

Skill content

cmds:
  move <dx> <dy>
  abs <x> <y>
  click [left|right|middle]
  hold [left|right|middle] <seconds>
  drag <dx> <dy> [left|right|middle] [hold_seconds]
  drag-smooth <dx> <dy> [steps] [left|right|middle]

Recommendation

Document all supported mouse actions in SKILL.md or ensure the agent only uses the listed commands.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

If a different local `molt-mouse` binary is present, the agent would run that binary rather than a reviewed installed artifact.

Why it was flagged

The skill expects a local `molt-mouse` command but does not provide an installation path in the install spec, so users need to confirm what binary will actually run.

Skill content

No install spec — this is an instruction-only skill.

Recommendation

Verify the local `molt-mouse` command path and contents before enabling the skill.