Xia Desktop Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:22 AM UTC
• Version: 1.1.0

Overview

This skill can control a Windows desktop, capture remote-access details, and send WeChat messages or files without strong confirmation or containment.

Review before installing. Only run this in a Windows account or VM where desktop control, screenshots, clipboard use, WeChat sends, file transfers, and ToDesk credential exposure are acceptable. Require fixes for strict app allowlisting, removal of shell=True fallback, blocking safety checks, explicit confirmations for remote credentials and WeChat sends, and secure screenshot handling before using it on a sensitive machine.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/desktop_agent.py:277

Finding

Arbitrary Command Execution Through Shell-Based Application Launching

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/safety.py:34

Finding

Dangerous Operations Are Detected but Explicitly Allowed

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/presets.py:14

Finding

Sensitive Desktop and Remote-Access Credentials Are Stored in Predictable Plaintext Screenshots

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Third-Party Dependencies Are Installed Without Version or Integrity Pinning

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The code generally matches the declared desktop automation purpose: it can capture screenshots, click, type, press keys, open apps, inspect windows, and do image matching for GUI automation. However, the description explicitly claims WeChat message/file sending and ToDesk remote connection capabilities, which are not implemented in this code chunk. While WeChat can be launched via open_app, there is no dedicated logic for composing/sending messages or files, nor any ToDesk-specific connection workflow. Additionally, the description implies a higher-level agent controlled by natural language or preset commands, but this file only contains low-level action methods and a simple CLI dispatcher. Therefore the description overstates capabilities relative to the supplied code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description presents a broad Windows desktop automation agent capable of general GUI control and multiple desktop actions. The supplied code chunk, however, is a limited preset-task script focused specifically on ToDesk and WeChat. While those two declared scenarios are partially represented, the ToDesk flow is materially different from the description: it launches ToDesk, takes a screenshot, and returns a fixed device code, leaving password recognition to an external caller rather than actually obtaining full credentials. Also, the code does not expose the broader general-purpose desktop automation capabilities described. This is best classified as a mismatch because the actual behavior is substantially narrower and partially different in its primary claimed workflow.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description presents the skill as an active Windows desktop automation agent. However, the supplied code chunk is only a safety restriction module. Its functions inspect text and execution plans for dangerous keywords, warn on risky content, and reject overly long plans. It does not interact with the desktop, launch or control applications, send messages, or create remote connections. Because the actual behavior is materially different from the declared primary purpose, this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises broad activation for arbitrary desktop control, which can cause the agent to invoke this high-risk skill for vague user requests. In the context of GUI automation with messaging, screenshots, and remote-access actions, ambiguous routing materially increases the chance of unauthorized or unsafe actions being triggered.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation describes screenshot capture, password recognition, and transmission of remote-access details without a clear warning that sensitive data may be collected and disclosed. In a desktop-automation skill, this omission undermines informed consent and can lead to exposure of credentials, personal messages, or other on-screen secrets.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The workflow explicitly instructs the agent to extract a dynamically generated remote-access password from a screenshot and relay it in plain language. This handles authentication secrets in an unsafe way and could expose live credentials to unauthorized parties, logs, chat history, or unintended recipients.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This procedure operationalizes collection of a device code and temporary password from the UI and instructs the agent to send them onward, effectively turning the skill into a credential-harvesting/transmission mechanism. Given the remote-control context, the impact includes unauthorized access, account compromise, and covert persistence through remote sessions.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This duplicate finding identifies the same dangerous sink: Popen(cmd, shell=True) with controllable input. The desktop-agent context increases severity because the tool is likely exposed to natural-language requests, which are especially susceptible to prompt injection and parameter manipulation.

Content

Scanner excerpt · scripts/desktop_agent.py (reported line 273)May include surrounding context.

python

"code": "code",
            }
            cmd = app_map.get(app_name.lower(), app_name)
            subprocess.Popen(cmd, shell=True)
            logger.info(f"启动应用: {app_name} -> {cmd}")
            return True
        except Exception as e:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This duplicate finding identifies the same dangerous sink: Popen(cmd, shell=True) with controllable input. The desktop-agent context increases severity because the tool is likely exposed to natural-language requests, which are especially susceptible to prompt injection and parameter manipulation.

Content

Scanner excerpt · scripts/desktop_agent.py (reported line 273)May include surrounding context.

python

"code": "code",
            }
            cmd = app_map.get(app_name.lower(), app_name)
            subprocess.Popen(cmd, shell=True)
            logger.info(f"启动应用: {app_name} -> {cmd}")
            return True
        except Exception as e:

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This function intentionally captures and returns remote-access connection material, including a device code and a screenshot intended for password extraction, without any visible authorization, warning, or confirmation step. In the context of a desktop-control skill, exposing ToDesk credentials can enable unauthorized remote access to the host and is therefore especially dangerous.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The task is expressly designed to collect remote-access credentials for later AI recognition/use, which creates a direct secret-exposure pathway. Given the skill's purpose of controlling a Windows desktop and establishing ToDesk connections, this materially lowers the barrier to unauthorized takeover of the machine if invoked by an untrusted workflow or prompt.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Automated file transfer over WeChat without confirmation or validation can exfiltrate arbitrary local files to external recipients under the user's identity. In a desktop-automation skill, this is more dangerous than text messaging because sensitive documents, credentials, or proprietary data may be transmitted with a single action.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents capabilities that imply shell execution and network-adjacent remote-access workflows, but it does not declare any explicit tool scope or permission boundaries. For a desktop-control skill, missing scope restrictions increases the chance of unintended command execution, data access, or exfiltration through overbroad agent/tool access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Trigger phrases such as '连接你' or generic remote-connection wording are ambiguous and prone to accidental invocation. Because the associated workflow can expose remote-access credentials and start a remote-control sequence, collision-prone triggers are dangerous in this skill context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The screenshot function captures the entire desktop and persists it to C:\temp\desktop_agent automatically. Because desktop screens frequently contain credentials, chats, documents, and other sensitive material, saving full-screen captures to disk increases exposure and leaves recoverable artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The fallback text-entry path copies arbitrary text to the system clipboard before pasting it. Clipboard contents are globally accessible to other applications and may persist after use, so sensitive tokens, messages, or secrets can be exposed unintentionally.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The open_app API is documented as opening applications, but its implementation allows arbitrary command execution because unknown input is used directly as a shell command. In the context of a desktop automation agent, this materially expands capability from GUI automation to full OS command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This finding reflects that application launch is actually shell-backed arbitrary command execution without meaningful safety controls. In a skill designed to control Windows and apps like WeChat or remote tools, this makes misuse more dangerous because it can pivot from intended automation into system-level command execution.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

open_app passes cmd to subprocess.Popen(..., shell=True) after falling back to raw app_name when the input is not in the allowlist. In a desktop-control skill, that means an attacker or prompt-injected agent action can execute arbitrary shell commands rather than merely launching approved applications.

Content

Scanner excerpt · scripts/desktop_agent.py (reported line 273)May include surrounding context.

python

"code": "code",
            }
            cmd = app_map.get(app_name.lower(), app_name)
            subprocess.Popen(cmd, shell=True)
            logger.info(f"启动应用: {app_name} -> {cmd}")
            return True
        except Exception as e:

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring says the function returns a dict containing both "device_code" and "temp_password". In the implementation, it instead returns a screenshot path, a fixed device code, and a "password_needs_recognition" flag, with no temporary password included. This is an active mismatch between documented intent and actual behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/presets.py (reported line 39)May include surrounding context.

python

agent = DesktopAgent()

    # Step 1: 启动ToDesk
    subprocess.Popen([TODESK_PATH])
    logger.info("ToDesk已启动")
    time.sleep(3)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/presets.py (reported line 59)May include surrounding context.

python

def wechat_ensure_running():
    """确保微信在运行"""
    import subprocess as sp
    r = sp.run(['tasklist'], capture_output=True, text=True)
    if 'Weixin' not in r.stdout:
        sp.Popen([WECHAT_PATH])
        import time; time.sleep(5)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/presets.py (reported line 61)May include surrounding context.

python

import subprocess as sp
    r = sp.run(['tasklist'], capture_output=True, text=True)
    if 'Weixin' not in r.stdout:
        sp.Popen([WECHAT_PATH])
        import time; time.sleep(5)
        logger.info('微信已启动')

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill can send arbitrary WeChat messages automatically with no confirmation at send time, no recipient verification, and no content review. In a desktop-agent context this increases the risk of social engineering, accidental disclosure, or abuse to message unintended contacts using the user's identity.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The task description and steps claim the preset gets both the device code and temporary password and returns the credentials. However, the handler returns only a fixed device code plus a screenshot path and a flag indicating the password still needs recognition. The registered intent therefore overstates what the code actually does.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.