Midscene Automations Skills for Computer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:49 PM UTC
• Version: 1.0.4

Overview

This skill is not clearly malicious, but it needs review because it can control a real desktop, capture visible screen data, and relies on under-scoped setup and safety guidance.

Install only if you specifically need full desktop automation. Use it in a dedicated VM or restricted OS account when possible, close or hide sensitive windows first, treat generated screenshots and reports as sensitive, avoid disabling lock-screen protection on a primary workstation, and prefer an exact pinned and reviewed Midscene package version rather than automatic floating `npx` execution.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:38

Finding

Automatic Execution of an Unpinned Remote npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 38
Vulnerability Type: Supply-chain risk through automatic runtime package installation
Risk Level: High

Vulnerable Code Snippet:

bash

npx -y @midscene/computer@1 connect

The same npx -y @midscene/computer@1 execution pattern is repeated throughout the documented commands.

Technical Analysis

The skill instructs the agent to use npx -y to retrieve and immediately execute @midscene/computer. The -y option suppresses the installation confirmation, while @1 constrains only the major version rather than selecting an exact, previously reviewed release. No lockfile or package-integrity hash is present in the audited project.

Consequently, the code executed by a future skill invocation may differ from the code available when the skill was reviewed. A compromised package publisher, npm account, package release, or transitive dependency could introduce arbitrary code into the runtime installation.

This risk is particularly significant because the dependency is intended to receive desktop-control permissions, capture screenshots, and control the real mouse and keyboard.

Attack Path

1. An attacker compromises the npm publisher account, the package, or one of its transitive dependencies.
2. The attacker publishes a malicious release compatible with the @1 version range.
3. A user or agent follows the skill instructions and runs an npx -y @midscene/computer@1 command.
4. npx automatically downloads the currently resolved package without interactive approval.
5. The downloaded package executes in the invoking user's environment.
6. Malicious package code abuses the process's filesystem, network, credential, or desktop-automation access.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running the skill. Depending on the host configuration, the malicious package coul ...[truncated 481 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version instead of the floating major-version range.
2. Declare the dependency in a package manifest and commit a lockfile containing resolved versions and integrity hashes.
3. Install dependencies as a separate, explicit setup operation rather than downloading and executing them during every invocation.
4. Verify package provenance, registry origin, publisher identity, signatures, and integrity before installation.
5. Use the official npm registry explicitly and enforce an approved dependency allowlist.
6. Disable package lifecycle scripts where compatible with the dependency.
7. Run desktop automation in an isolated VM or restricted operating-system account with limited filesystem and credential access.
8. Regularly scan the pinned package and all transitive dependencies for known vulnerabilities and unexpected ownership changes.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:233

Finding

Troubleshooting Guidance Weakens Workstation Lock-Screen Protection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 233-242
Vulnerability Type: Unsafe security configuration guidance
Risk Level: Medium

Vulnerable Code Snippet:

markdown

### macOS: Screenshot Returns a Black Screen
If `take_screenshot` returns a completely black image, the Mac is likely **locked** (e.g. screen is at the login/lock window). This is a system-level restriction — macOS prohibits capturing the screen contents while the session is locked, so there is no workaround at the application level.

**Recommended fix:** Use a **screensaver** instead of locking the screen. A screensaver keeps the user session active and unlocked, allowing screenshots to capture normally.

1. Open **System Settings > Lock Screen**
2. Set "Require password after screen saver begins or display is turned off" to a longer delay (or turn it off during automation)
3. Optionally configure a screensaver under **System Settings > Screen Saver** so the display still dims after inactivity without locking

Technical Analysis

The troubleshooting instructions recommend extending or disabling the password requirement so the desktop session remains unlocked for screenshot capture. This deliberately weakens a host security control and leaves the authenticated user session available while unattended.

Maintaining an unlocked session is operationally related to screenshot-based automation, but disabling password enforcement is broader than necessary and violates least-privilege and secure-default principles. The document also does not require an isolated account, an attended session, a time limit, or automatic restoration of the original lock-screen setting.

Attack Path

1. A user follows the troubleshooting instructions after receiving black screenshots.
2. The user increases the password delay or turns off the password requirement.
3. The computer remains logged in and unlocked after the display turns off or the scr ...[truncated 901 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the recommendation to turn off password enforcement.
2. Require desktop automation to run only during an attended, explicitly time-bounded session.
3. Use a dedicated restricted account or isolated VM that contains no unrelated credentials or sensitive applications.
4. If a temporary lock-screen adjustment is unavoidable, document the original value, apply the smallest possible delay, and restore the setting immediately after automation.
5. Add a mandatory cleanup checklist that disconnects automation, closes sensitive sessions where authorized, and verifies restoration of the lock policy.
6. Prefer automation infrastructure designed for unattended testing, such as disposable virtual desktops, rather than weakening the security policy of a user's primary workstation.
7. Warn users that screensavers do not protect an unlocked session unless password enforcement remains enabled.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description warns that the skill takes over the user's mouse and keyboard, but it does not explicitly warn that screenshots, HTML reports, replay artifacts, and extracted outputs may capture sensitive information visible on the desktop. In this context, the omission is dangerous because the skill is explicitly screenshot-driven and recommends generating detailed reports, increasing the risk of collecting secrets, messages, documents, or personal data from unrelated windows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list contains broad, everyday phrases such as 'open app', 'press key', 'desktop', and 'type text' that can cause this high-privilege skill to be invoked when the user did not specifically intend full desktop takeover. Because the skill controls the real mouse and keyboard and operates from screenshots, accidental invocation could lead to unintended actions in sensitive applications or exposure of on-screen data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.