ClawHub
Back to skill

Security audit

游戏自动化-向僵尸开炮

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent game automation skill, but it controls the real mouse and captures the screen while disabling a built-in emergency stop, so users should review it carefully before running it.

Install only in a dedicated virtual environment and run it as a normal user while the intended game window is open and visible. Be aware that it will capture game-window screenshots, write logs, use a global Ctrl+Q hotkey, and move/click the real mouse; because the PyAutoGUI corner fail-safe is disabled, be prepared to terminate the process externally if Ctrl+Q does not work.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Python Dependencies Create a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-6; installation instructions at SKILL.md:21-24 and README.md:12
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code:

text
pywin32
rapidocr
onnxruntime
pyautogui
loguru
keyboard

Associated installation command:

bash
pip install -r requirements.txt

Technical Analysis

Every executable Python dependency is specified without an exact version or cryptographic hash. Consequently, package resolution depends on whatever releases and package-index state exist at installation time. The installed code may therefore differ from the code reviewed during this audit.

These dependencies have security-sensitive capabilities, including desktop screenshots, global keyboard hooks, simulated mouse input, native Windows integration, and OCR model execution. A compromised package release, dependency takeover, or malicious package-index configuration could introduce arbitrary code during installation or import.

The audit did not identify a currently malicious dependency or an unsafe third-party index in the active installation command. This finding concerns the absence of reproducible, integrity-verified dependency resolution.

Attack Path

  1. An attacker compromises an allowed dependency, its maintainer account, or the package distribution channel.
  2. The attacker publishes a malicious release under the same package name.
  3. A user follows the documented pip install -r requirements.txt command.
  4. Because no exact versions or hashes are required, pip may resolve and install the malicious release.
  5. Installation hooks or module initialization execute attacker-controlled code when the package is installed or when start.py imports it.

Impact Assessment

Malicious dependency code would execute with the privileges of the user running pip or the automation script. It could potentially acce ...[truncated 390 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a reviewed, exact version using ==.
  2. Generate a fully resolved lock file that also constrains transitive dependencies.
  3. Record cryptographic hashes for all distributions and install with:
    bash
    pip install --require-hashes -r requirements.txt
  4. Download packages only from an explicitly approved HTTPS package index.
  5. Review dependency ownership, release history, and known vulnerabilities before updating pins.
  6. Perform installation and execution in a dedicated virtual environment under a non-administrative account.
  7. Remove any dependencies that are not required at runtime.
  8. Add automated dependency and lock-file scanning to the release process.

T09 · Insecure Skill Coding Practices

Note
Location
GameControl.py:7
Finding

Desktop Automation Disables the PyAutoGUI Emergency Fail-Safe

Content
View full analysis

Vulnerability Details

File Location: GameControl.py:7; equivalent configuration at GameControlPro.py:9
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Low

Vulnerable code from GameControl.py:

python
pyautogui.FAILSAFE = False
logger.add("file_{time}.log")

handle=win32helper.GetHandle('向僵尸开炮')

winX,winY,winWidth,winHeight=win32helper.GetWin(handle)

Equivalent vulnerable configuration from GameControlPro.py:

python
pyautogui.FAILSAFE = False
logger.add("file_{time}.log")

The affected controllers subsequently issue automated clicks based on OCR results and cached window coordinates, including:

python
pyautogui.click(winX+x, winY+y)

Technical Analysis

PyAutoGUI normally provides an emergency interruption mechanism when the user moves the pointer to a screen corner. Both controllers explicitly disable this protection while their entry points run repeated, unattended click loops.

Window coordinates are captured during module initialization and are not refreshed before each click. If the target window moves, closes, changes size, or loses focus, the stored coordinates may no longer refer to the intended controls. OCR errors can also cause incorrect click decisions. With the built-in fail-safe disabled, the user loses an independent emergency method for interrupting erroneous mouse automation.

A Ctrl+Q hotkey is registered by both entry points, but it is not an equivalent defense. Global hotkey handling can fail because of focus, permissions, keyboard-hook problems, or process responsiveness. In addition, the Pro entry point does not include runFlag in its nested-loop condition, so stopping may be delayed until that loop reaches a return condition.

Attack Path

  1. The user launches start.py or start_pro.py.
  2. The controller disables the PyAutoGUI fail-safe and stores the target window's coordinates.
  3. The game window is ...[truncated 1306 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the assignment or explicitly retain the safe default:
    python
    pyautogui.FAILSAFE = True
  2. Configure a short pyautogui.PAUSE interval so the operator has time to interrupt automation.
  3. Reacquire and validate the window handle and geometry immediately before each screenshot and click.
  4. Confirm that the intended game window is still present and is the foreground window before issuing input.
  5. Stop rather than click when OCR confidence is insufficient or coordinates fall outside the validated window bounds.
  6. Check the stop flag before every click and include it in every nested loop condition. In start_pro.py, use a condition such as:
    python
    while backFlag == False and runFlag:
  7. Provide a second independent termination control, such as a visible stop control or a watchdog with a bounded runtime.
  8. Preserve detailed logs of rejected and executed clicks without recording unrelated sensitive desktop content.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (20)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code performs OCR-driven GUI automation and issues real mouse clicks to a live window with fail-safe protection explicitly disabled. Unattended input injection can cause unintended in-game purchases, disruptive system interaction if window coordinates are wrong or focus changes, and removes an important user safety stop.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file contains comments, OCR target strings, window title matching, and log messages exclusively in Chinese, implying the skill expects and operates in a fixed language/locale. There is no natural-language indication that this locale restriction is optional, user-selectable, or justified as a region-specific tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This script automates OCR-driven GUI interaction and issues unattended clicks against a live desktop application with pyautogui while explicitly disabling the FAILSAFE. That creates real safety risk because mis-detection, window focus changes, or stale coordinates can cause unintended clicks on the user's system without confirmation or an emergency stop.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill documentation is presented entirely in Chinese from the title onward, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-only audience. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This function captures part of the user's screen and writes the image to disk without any notice, consent flow, or access control. Silent screenshot capture can expose sensitive on-screen information such as messages, credentials, or personal data, especially because the target window title is hardcoded and the file is saved automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

These additional functions also perform silent screen capture and persist the result to a local file, increasing the number of code paths that can collect on-screen content without user awareness. Even if intended for game automation, the same behavior can be repurposed to collect sensitive visual data from the user's desktop or targeted application window.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script is tied to Chinese-language window titles and OCR target strings such as '向僵尸开炮', '开始游戏', and '返回', which effectively forces a specific language/locale. There is no natural-language indication that the user can choose another language or that the restriction is an explicit opt-in constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill silently creates timestamped log files on disk via logger.add("file_{time}.log") without notifying the user or documenting retention. While not overtly malicious, logs can expose usage patterns, OCR-derived game state, or other operational details and create privacy and disk-hygiene concerns.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This manifest-style JSON uses Chinese for monster names, categories, and gameplay guidance throughout, but provides no indication that the skill is China-specific or that users can opt into this locale. Under the policy, hard-coding a language without user choice or justification is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The dependency version is specified with a caret (^0.1.6), which permits installation of newer matching releases rather than a single fixed version. This weakens build reproducibility and can unintentionally introduce a vulnerable or malicious upstream release during future installs, even though the package.json alone does not prove active exploitation.

Content

Scanner excerpt · package.json (reported line 3)May include surrounding context.

json
{
  "dependencies": {
    "imghdr": "^0.1.6"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency list leaves pywin32 unpinned, so installs may resolve to different versions over time, reducing build reproducibility and making it impossible to verify whether a safe release is used. In a package with native Windows bindings, this increases supply-chain and patch-management risk, even though the file alone does not prove active exploitation.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
pywin32
rapidocr
onnxruntime
pyautogui

Unverifiable Dependency: pywin32 has 2 known advisory(ies) (CVE-2021-32559 (Integer overflow in pywin32); CVE-2021-32559 (An integer overflow exists in pywin32 prior to version b301 when adding an acces)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
96% confidence
Finding

pywin32 has known advisories, but the manifest does not pin a version, so there is no way to determine whether installations will receive a patched or affected release. Because pywin32 exposes Windows-native functionality, using an unverifiable version can increase the impact of any underlying memory-safety or privilege-related flaw.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

rapidocr is unpinned, so dependency resolution can drift across environments and time. That weakens reproducibility and makes it harder to assess whether vulnerable or malicious upstream releases could be introduced during installation.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
pywin32
rapidocr
onnxruntime
pyautogui
loguru

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

onnxruntime is declared without a version constraint, which means consumers may install different builds with different security and behavior characteristics. For an ML runtime that often includes native code, unpinned installation creates avoidable supply-chain uncertainty.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
pywin32
rapidocr
onnxruntime
pyautogui
loguru
keyboard

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

pyautogui is unpinned, so the installed version may vary and could introduce unsafe changes or vulnerable releases unexpectedly. Because this library automates user input and GUI interaction, unexpected dependency drift can be more operationally dangerous than a typical utility package.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text
pywin32
rapidocr
onnxruntime
pyautogui
loguru
keyboard
# pip install paddlepaddle-gpu==3.0.0 -i https://www.paddlepaddle.org.cn/packages/stable/cu118/

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

loguru is unpinned, preventing verification that the installed version avoids known issues and producing non-reproducible builds. Logging libraries can affect confidentiality if insecure versions mishandle or expose sensitive data.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text
rapidocr
onnxruntime
pyautogui
loguru
keyboard
# pip install paddlepaddle-gpu==3.0.0 -i https://www.paddlepaddle.org.cn/packages/stable/cu118/
# paddlepaddle-gpu==3.0.0

Unverifiable Dependency: loguru has 2 known advisory(ies) (CVE-2022-0338 (loguru logs sensitive information); CVE-2022-0338 (Improper Privilege Management in Conda loguru prior to 0.5.3.)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
95% confidence
Finding

loguru has known advisories, and without version pinning the project cannot demonstrate that a fixed release will be installed. Insecure logging behavior can expose sensitive information or weaken operational security, especially if this skill handles screenshots, OCR output, or user input.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

keyboard is unpinned, allowing unreviewed versions to be pulled at install time. Since this package can capture or synthesize keyboard events, dependency drift raises the risk of unexpectedly introducing behavior with privacy or control implications.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text
onnxruntime
pyautogui
loguru
keyboard
# pip install paddlepaddle-gpu==3.0.0 -i https://www.paddlepaddle.org.cn/packages/stable/cu118/
# paddlepaddle-gpu==3.0.0
# rapidocr_paddle

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code emits all visible status and control messages in Chinese only, including stop instructions and startup banners. Under the policy, a fixed language without user opt-in or documented regional justification is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The file uses Chinese-only natural-language comments and a hard-coded Chinese window title string, with no indication that the skill supports language choice or that the locale restriction is intentional and documented. This may violate language/locale policy if the skill is expected to operate without forcing a specific language context on users.

Content

No source excerpt is available for this finding.