dekstop-control-linux

• Outcome: Review
• Latest audit: May 29, 2026 · 9:24 PM UTC
• Version: 1.0.0

Overview

This is a legitimate Linux desktop automation skill, but it gives broad control and observation of the active desktop with weakly scoped approval behavior.

Install only if you intentionally want an agent to control and observe your Linux desktop. Keep approval mode enabled, avoid copying examples that set require_approval=False, close sensitive windows, do not use real credentials in workflows, and treat screenshots, recordings, OCR output, logs, and clipboard contents as sensitive data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill advertises substantial capabilities including shelling out to tools like ffmpeg, wmctrl, xdotool, xclip/xsel, reading environment state, and writing files such as screenshots and recordings, yet it declares no permissions. That creates a trust and policy gap: consumers may approve or install the skill without understanding it can read desktop state, capture data, and write artifacts to disk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The description frames the skill as safe desktop automation for mouse, keyboard, and screenshots, but the documented interface goes well beyond that into OCR, screen recording, clipboard access, browser/app launching, credential entry, window enumeration, and action replay. This mismatch understates surveillance and automation power, increasing the chance of unsafe use, overbroad trust, and accidental exposure of sensitive screen contents, credentials, or clipboard data.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill description presents the capability as mouse/keyboard/screenshot automation, but the implementation can record full-screen video via ffmpeg. In an agent-skill setting, this undisclosed surveillance capability materially increases data-exfiltration and privacy risk because users or reviewers may authorize the skill under a narrower understanding of its access.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The code performs OCR and screen text extraction, but that capability is omitted from the declared description. This matters because OCR can harvest sensitive on-screen data such as messages, tokens, and personal information beyond simple automation.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: Clipboard read/write access is implemented but not disclosed in the skill description. Clipboard contents often contain passwords, secrets, and copied private data, so hidden clipboard access meaningfully broadens the skill's ability to collect or alter sensitive information.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The skill includes browser navigation and login-form automation, which expands it from generic desktop control into credential-handling workflows. In this context, the combination of typing, window focus, URL navigation, and login helpers raises the risk of credential misuse, phishing automation, or accidental entry into the wrong window.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: External system tools are used for monitor discovery and related desktop control beyond the narrow description of basic input/screenshot handling. In an agent skill, undeclared reliance on system binaries expands operational power and attack surface, especially when paired with other UI-control features.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Multiple examples explicitly set require_approval=False for screenshots, screen recording, browser automation, login automation, OCR, and replayable workflows, normalizing unattended desktop control without warning. In a desktop-control skill, that is especially dangerous because these actions can capture sensitive information, drive authenticated sessions, and manipulate the user's environment with little friction.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Screen recording captures the entire desktop and may include sensitive documents, tokens, chats, and credentials, yet the method does not require user-facing confirmation. In a desktop automation skill, undisclosed video capture is especially dangerous because the same tool can navigate to sensitive contexts and then silently record them.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Screenshot saving writes screen contents to disk without any consent or disclosure beyond the method signature. Persisting screen contents creates privacy and data-handling risk because captured images can contain confidential on-screen material and may remain accessible on disk.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.