Back to plugin

Security audit

OpenCoven Desktop Use

Security checks across malware telemetry and agentic risk

Overview

The plugin is internally consistent: it registers a desktop automation tool that delegates to an external coven-desktop-use binary, and its code and instructions align with that purpose.

This plugin is a thin adapter/bridge: it does not itself perform desktop automation but runs a separate local binary (coven-desktop-use) to do so. Before installing, verify the adapter binary source (the GitHub repo) and consider building the adapter from source rather than using prebuilt artifacts. Note that the adapter will perform local UI actions (mouse/keyboard/screenshot) and on macOS will require Accessibility/Screen Recording permissions — granting those permits the adapter to interact with your desktop. The plugin enforces explicit confirmation for interactive actions and avoids shell interpolation, which reduces injection risk, but you should still: (1) review the adapter repository code or releases, (2) only install from a trusted origin, and (3) set COVEN_DESKTOP_USE_BIN if you want to pin a specific local binary path/version.

VirusTotal

No VirusTotal findings

View on VirusTotal

Static analysis

No suspicious patterns detected.