ClawHub
Back to skill

Security audit

Wincontrol

Security checks for vulnerabilities and agentic risk

Overview

WinControl is openly a Windows screen-capture and desktop-control skill, but it exposes that high-impact control through an unauthenticated local HTTP API while running.

Only install and run this on a trusted machine when you intentionally want local desktop automation. Do not leave the server running on shared or untrusted systems; avoid disabling the firewall; prefer adding authentication or other access controls before use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
server.py:319
Finding

Unauthenticated Desktop-Control API with Permissive Cross-Origin Access

Content
View full analysis

Vulnerability Details

File Location: server.py:319-339, server.py:360-379, and server.py:416
Vulnerability Type: Missing authentication and overly permissive CORS on a security-sensitive local API
Risk Level: High

Vulnerable Code

python
def _send_json(self, data, status=200):
    try:
        self.send_response(status)
        self.send_header('Content-Type', 'application/json')
        self.send_header('Access-Control-Allow-Origin', '*')
        self.end_headers()
        self.wfile.write(json.dumps(data).encode())
    except Exception as e:
        print(f"Error sending response: {e}")

def _send_error(self, message, status=400):
    self._send_json({"ok": False, "error": message}, status)

def do_OPTIONS(self):
    self.send_response(200)
    self.send_header('Access-Control-Allow-Origin', '*')
    self.send_header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS')
    self.send_header('Access-Control-Allow-Headers', 'Content-Type')
    self.end_headers()

Sensitive operations are then dispatched without any authentication or authorization check:

python
if path == '/capture':
    cap_result = capture(quality=data.get('quality'))
    result = cap_result
elif path == '/move':
    result = handle_move(data.get('x'), data.get('y'))
elif path == '/click':
    result = handle_click(data.get('x'), data.get('y'), data.get('button', 'left'))
elif path == '/drag':
    result = handle_drag(data.get('x1'), data.get('y1'),
                        data.get('x2'), data.get('y2'),
                        data.get('button', 'left'))
elif path == '/scroll':
    result = handle_scroll(data.get('x'), data.get('y'),
                          data.get('direction', 'down'), data.get('amount', 3))
elif path == '/enter':
    result = handle_enter(data.get('keys', []))

The service is restricted to loopback, but this does not protect it from local proc ...[truncated 2728 chars]

Remediation
View remediation

Remediation Suggestions

  1. Generate a cryptographically random secret for every server session and require it in an Authorization: Bearer header for all endpoints except, if necessary, a minimal health check.
  2. Store the secret with user-only permissions and never place it in URLs, where it may leak through logs or browser history.
  3. Remove Access-Control-Allow-Origin: *. If browser integration is required, use a strict allowlist of trusted origins and reject requests with missing or unexpected Origin headers.
  4. Restrict accepted methods and require Content-Type: application/json for action endpoints.
  5. Consider separate privileges for capture and input injection, allowing clients to receive only the capabilities they require.
  6. Add rate limits and maximum action-sequence lengths to reduce automated abuse.
  7. Require explicit user confirmation for high-impact keyboard combinations or provide an emergency stop mechanism.
  8. Continue binding to loopback and document that loopback binding is defense in depth, not a substitute for authentication.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:24
Finding

Unpinned Third-Party Runtime Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:24-27; equivalent commands also appear in README.md:17-20 and CONTRIBUTING.md:13-16
Vulnerability Type: Unversioned and unhashed dependency installation
Risk Level: Medium

Vulnerable Code

powershell
# Install dependencies (one-time)
pip install pywin32 pillow mss

The same unpinned installation pattern is repeated elsewhere:

bash
pip install pywin32 pillow mss
python server.py

Technical Analysis

The installation instructions retrieve the latest versions available under the package names pywin32, pillow, and mss. No exact versions, integrity hashes, lockfile, or reviewed package index are specified.

These are established package names, and the audited project contains no evidence of typosquatting or an intentionally malicious dependency. Nevertheless, the installation is not reproducible: future versions are automatically trusted even though they were not part of this audit. Python package installation can execute package build or installation logic with the invoking user's privileges.

This is a supply-chain weakness rather than evidence that the currently named dependencies are malicious.

Attack Path

  1. A dependency publisher account, package release process, or configured Python package index is compromised.
  2. A malicious or otherwise unsafe new version is published under one of the dependency names.
  3. A user follows the documented unpinned pip install command.
  4. Pip downloads the new release because no approved version or hash is required.
  5. Malicious installation or imported runtime code executes with the privileges of the user running WinControl.

Impact Assessment

A compromised dependency could execute arbitrary code during installation or when server.py imports it. The resulting access would generally equal the privileges of the invoking Windows user and could include access to that user' ...[truncated 200 chars]

Remediation
View remediation

Remediation Suggestions

  1. Publish a reviewed requirements.txt or lockfile containing exact dependency versions.
  2. Include SHA-256 hashes and install with pip install --require-hashes -r requirements.txt.
  3. Test and periodically update pinned versions through a controlled review process.
  4. Recommend installation in a dedicated virtual environment rather than the global Windows Python environment.
  5. Document the expected package index and advise against untrusted mirrors or additional indexes.
  6. Where practical, distribute signed releases and provide checksums for project artifacts.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:272
Finding

Troubleshooting Guidance Recommends Disabling Windows Firewall

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:272-275
Vulnerability Type: Unsafe security-control bypass guidance
Risk Level: Low

Vulnerable Code

text
**Issue**: Cannot access from WSL
- Ensure Windows Firewall allows Python through
- Try disabling Windows Defender Firewall temporarily for testing

Technical Analysis

The documentation recommends temporarily disabling Windows Defender Firewall to diagnose WSL connectivity. This weakens a host-wide security boundary and is broader than necessary for a service intended to bind only to localhost.

Disabling the firewall affects unrelated applications and listening ports, not just WinControl. It therefore exceeds the minimum privileges and configuration changes required for the Skill's declared functionality. A narrowly scoped firewall rule or loopback-specific diagnostic procedure would avoid this exposure.

Attack Path

  1. A user cannot reach the WinControl service from WSL.
  2. The user follows the troubleshooting instructions and disables Windows Defender Firewall.
  3. Other services listening on network interfaces become reachable under the host's remaining network configuration.
  4. An attacker on an accessible network probes and exploits an unrelated exposed service before the firewall is re-enabled.

This path depends on the presence of another vulnerable or sensitive listening service and network reachability.

Impact Assessment

The direct impact is a temporary reduction in host network protection. The ultimate privileges available to an attacker depend on which unrelated services become exposed and their security posture. The instruction does not itself grant administrative privileges to an attacker or modify WinControl's loopback binding.

Remediation
View remediation

Remediation Suggestions

  1. Remove the recommendation to disable Windows Defender Firewall.
  2. Provide loopback and WSL networking diagnostics, including verification of the actual bind address and Windows-to-WSL forwarding behavior.
  3. If a firewall exception is genuinely required, document a narrowly scoped rule limited to the necessary executable, profile, interface, address range, and TCP port.
  4. Include commands to inspect and remove any temporary rule after testing.
  5. Do not recommend exposing the unauthenticated service beyond loopback; implement authentication before documenting any non-loopback deployment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (21)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation provides direct examples for mouse movement, clicking, dragging, typing, launching applications, and other desktop-control actions, but does not place prominent warnings near those examples about destructive side effects such as data loss, unintended purchases, credential entry, or system changes. Because the skill can directly manipulate the user interface, even benign misuse can have serious real-world consequences.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

Mouse Actions

bash
# Move cursor (no click)
curl -X POST http://localhost:8767/move -d '{"x": 500, "y": 300}'

# Click
curl -X POST http://localhost:8767/click -d '{"x": 500, "y": 300}'

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · stop.sh (reported line 11)May include surrounding context.

sh
$PWSH -Command "Get-Process python -ErrorAction SilentlyContinue | Where-Object {\$_.CommandLine -like '*wincontrol*'} | Stop-Process -Force" 2>/dev/null

# Clean up frames
rm -rf /tmp/wincontrol/*.jpg 2>/dev/null

# Verify stopped
if curl -s --max-time 1 http://localhost:8767/ping > /dev/null 2>&1; then

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · stop.sh (reported line 11)May include surrounding context.

sh
$PWSH -Command "Get-Process python -ErrorAction SilentlyContinue | Where-Object {\$_.CommandLine -like '*wincontrol*'} | Stop-Process -Force" 2>/dev/null

# Clean up frames
rm -rf /tmp/wincontrol/*.jpg 2>/dev/null

# Verify stopped
if curl -s --max-time 1 http://localhost:8767/ping > /dev/null 2>&1; then

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · stop.sh (reported line 11)May include surrounding context.

sh
$PWSH -Command "Get-Process python -ErrorAction SilentlyContinue | Where-Object {\$_.CommandLine -like '*wincontrol*'} | Stop-Process -Force" 2>/dev/null

# Clean up frames
rm -rf /tmp/wincontrol/*.jpg 2>/dev/null

# Verify stopped
if curl -s --max-time 1 http://localhost:8767/ping > /dev/null 2>&1; then

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This is a markdown file, so SQP-2 applies to omissions in user-visible documentation. The listed capabilities include desktop remote control, screenshot capture, and keyboard/mouse input, which can affect user data and system integrity, but the changelog text provides no cautionary warning or disclosure about those risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README advertises screenshot capture and remote mouse/keyboard control over an HTTP API but provides no prominent warning about the privacy, consent, and host-compromise risks of exposing such capabilities. In this context, the skill is specifically designed for remote desktop control, so omission of safety guidance materially increases the chance of unsafe deployment, unauthorized surveillance, or abuse by other local/network actors.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 25)May include surrounding context.

md
python server.py

# Test
curl http://localhost:8767/ping

# Capture with custom quality
curl -X POST http://localhost:8767/capture -H "Content-Type: application/json" -d '{"quality": 60}'

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill exposes powerful capabilities including shell usage, network access, screenshot capture, and desktop input control, but its manifest does not declare any explicit tool scope or permission boundaries. That omission makes it easier for an agent platform to invoke the skill too broadly or without clear operator understanding of its risk envelope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The description is broad and generic for a highly privileged skill, with no activation constraints such as requiring explicit user approval, local-only trusted session use, or prohibiting background/autonomous operation. A broad trigger surface increases the chance that an agent may select this skill in inappropriate contexts and perform unintended desktop actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

bash
# Health check
curl http://localhost:8767/ping
# Output: {"ok": true}

# Capture a screenshot

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

text
Returns: `{"ok": true, "path": ".../screenshot.jpg", "quality": 90}`

Each capture overwrites `screenshot.jpg` in the skill directory. The file is automatically deleted when the server stops.

**Optional quality override:**
```bash

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 311)May include surrounding context.

text
Returns: `{"ok": true, "path": ".../screenshot.jpg", "quality": 90}`

Each capture overwrites `screenshot.jpg` in the skill directory. The file is automatically deleted when the server stops.

**Optional quality override:**
```bash

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

Mouse Actions

bash
# Move cursor (no click)
curl -X POST http://localhost:8767/move -d '{"x": 500, "y": 300}'

# Click
curl -X POST http://localhost:8767/click -d '{"x": 500, "y": 300}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

Click and Verify

bash
# Click somewhere
curl -X POST http://localhost:8767/click -d '{"x": 500, "y": 300}'
sleep 0.5

# Capture to see result

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.

md
### Troubleshooting

**Issue**: Server starts but curl fails
- Check if port 8767 is in use: `lsof -i :8767`
- Kill existing process: `kill <PID>`

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 327)May include surrounding context.

md
return r.json().get("path")

def click(x, y):
    requests.post(f"{API}/click", json={"x": x, "y": y})

def enter(keys):
    requests.post(f"{API}/enter", json={"keys": keys})

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 330)May include surrounding context.

md
requests.post(f"{API}/click", json={"x": x, "y": y})

def enter(keys):
    requests.post(f"{API}/enter", json={"keys": keys})

# Example workflow
if __name__ == "__main__":

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The /capture endpoint triggers full-screen capture and writes the image to disk in a predictable location without any authentication, authorization, user consent, or visibility controls. In this skill’s context, screenshots can expose highly sensitive desktop content such as credentials, messages, documents, and tokens, making the issue more dangerous than a generic logging/privacy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The HTTP API exposes mouse movement, clicks, dragging, scrolling, and keyboard entry that can directly control the Windows desktop, yet there is no authentication, authorization, CSRF protection, or user confirmation. Although bound to localhost, any local process—and potentially a malicious web page via permissive CORS depending on browser behavior and local app interaction—could drive arbitrary system actions, leading to command execution, data exfiltration, destructive changes, or privilege abuse through the user’s active session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This shell script forcibly stops matching Python processes with Stop-Process -Force and recursively deletes JPG files under /tmp/wincontrol. Although the script prints that it is stopping the server, it does not clearly disclose the destructive cleanup behavior or provide confirmation before terminating processes and deleting files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.