Mac Compute Use

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:03 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed macOS GUI automation tool, but it asks users to install an unpinned third-party MCP server and grant persistent Accessibility control over desktop apps.

Install only if you trust the third-party MCP server and need desktop-level macOS automation. Review or pin the Homebrew dependency before use, grant Accessibility only on a trusted machine, avoid using it around passwords, financial actions, private messages, and account administration unless explicitly intended, and revoke Accessibility and mcporter registration when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:24

Finding

Unpinned Third-Party Homebrew Dependency with Accessibility Privileges

Content

View full analysis

Vulnerability Details

File Location: scripts/setup.sh:24-25; also declared in SKILL.md:18 and documented in SKILL.md:35-37
Vulnerability Type: Unpinned third-party dependency installed from a mutable package source
Risk Level: Medium

Vulnerable Code

scripts/setup.sh:24-25:

bash

brew tap reedburns/mcp-server-macos-use
brew install mcp-server-macos-use

SKILL.md:18:

yaml

"command": "brew tap reedburns/mcp-server-macos-use && brew install mcp-server-macos-use",

SKILL.md:35-37:

bash

brew tap reedburns/mcp-server-macos-use
brew install mcp-server-macos-use

Technical Analysis

The setup process adds a third-party Homebrew tap and installs the currently available mcp-server-macos-use formula without pinning an immutable formula revision, package version, artifact checksum, or cryptographic signature. Consequently, the code executed during installation and the installed binary can change after the Skill has been reviewed.

This creates a supply-chain trust boundary: the effective implementation depends on the current contents of the external reedburns/mcp-server-macos-use tap. The risk is amplified because the documentation subsequently directs the user to grant the installed server macOS Accessibility permission. That permission is consistent with the Skill's stated GUI-automation purpose, but it gives a compromised dependency significant ability to observe and manipulate application interfaces.

No evidence in the audited project establishes that the named dependency is currently malicious. The vulnerability is the lack of immutable dependency selection and integrity verification, which would permit a compromised or unexpectedly modified upstream release to be installed.

Attack Path

1. An attacker compromises the third-party tap, a maintainer account, its release artifacts, or another relevant upstream distribution component.
2. The attack ...[truncated 1610 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed release and immutable Homebrew formula commit rather than installing whichever version is current.
2. Verify downloaded artifacts against a project-maintained SHA-256 checksum or a trusted cryptographic signature before installation.
3. Record the expected package version, formula revision, source repository, and checksum in the Skill documentation and setup script.
4. Fail closed if the resolved package version or digest differs from the approved value.
5. Review upstream changes before updating the pinned version, with particular attention to code that accesses the Accessibility API, launches subprocesses, reads files, or communicates over the network.
6. Clearly explain the security implications of Accessibility permission and instruct users to revoke that permission when the server is no longer required.
7. Prefer a reproducible release artifact from a trusted source, and consider vendoring or building from a pinned source commit in a controlled process when feasible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill documents powerful GUI automation and UI traversal capabilities but does not prominently warn that it can read on-screen content and interact with any accessible application on the user's Mac. Without a clear warning, users and orchestrators may underestimate that the skill effectively has broad desktop surveillance and input-injection capability, which can expose secrets or trigger sensitive actions across apps.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description is extremely broad and encourages activation for virtually any macOS GUI task, including reading screen content and controlling browsers or native apps. Because this skill grants desktop-wide Accessibility control, over-broad routing can cause it to be invoked in contexts involving sensitive data entry, messaging, mail, account settings, or other privileged workflows, increasing the chance of unintended data exposure or destructive actions.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Granting macOS Accessibility permission gives the server the ability to observe UI state and inject input across many applications, which is a highly privileged capability. While this permission is functionally required for the stated purpose, it still meaningfully expands the attack surface: if the MCP server, invoking agent, or routing logic is misused, the permission can be leveraged to manipulate apps or access sensitive on-screen information.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

mcporter config add macos-use --transport stdio --command $(which mcp-server-macos-use)

text

3. Grant Accessibility permission:
   **System Settings → Privacy & Security → Accessibility** → add `mcp-server-macos-use`

4. Verify:

Static analysis

No suspicious patterns detected.