Security audit
Security checks for vulnerabilities and agentic risk
The skill does what it says by automating an X11 desktop, but that gives an agent broad screen-capture and keyboard/mouse control with only minimal safety boundaries.
Review this carefully before installing. It is not evidence of malware, but it gives an agent the ability to view your screen, type, click, focus windows, and open URLs in a real X11 session. Use it only in a trusted, isolated desktop session where visible private data, credentials, and destructive applications are not exposed.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def run(ctx: Ctx, cmd, check=True, capture=False):
env = os.environ.copy()
env["DISPLAY"] = ctx.display
env["XAUTHORITY"] = ctx.xauthority
if capture:
The skill exposes shell and environment-dependent desktop-control capabilities but does not declare any explicit tool scope or permission boundaries. In this context, the skill can capture screenshots and inject mouse/keyboard input into a live X11 session, so the absence of scoped permissions increases the risk of unintended credential capture, destructive GUI actions, or abuse by downstream agents.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Ubuntu/Debian:
sudo apt-get update
sudo apt-get install -y xdotool scrot
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Ubuntu/Debian:
sudo apt-get update
sudo apt-get install -y xdotool scrot
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
env["DISPLAY"] = ctx.display
env["XAUTHORITY"] = ctx.xauthority
if capture:
return subprocess.run(cmd, env=env, check=check, text=True, capture_output=True)
return subprocess.run(cmd, env=env, check=check)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
env["XAUTHORITY"] = ctx.xauthority
if capture:
return subprocess.run(cmd, env=env, check=check, text=True, capture_output=True)
return subprocess.run(cmd, env=env, check=check)
def require_bins(*bins):
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
raise SystemExit(
"Missing required command(s): "
+ ", ".join(missing)
+ "\nInstall (Debian/Ubuntu): sudo apt-get install -y "
+ " ".join(missing)
)
The screenshot command captures and stores desktop images without any disclosure, consent check, or retention control. On a live desktop this can expose sensitive information visible on screen, including credentials, messages, tokens, or personal data, especially when used by an automated agent loop.
The click, type, and key functions provide direct GUI actuation with no confirmation, policy check, or safety interlock. In this context, that is powerful: an upstream agent can drive authentication dialogs, send messages, modify settings, or trigger destructive actions on the user's desktop.
The skill metadata describes screenshot and GUI input automation, but the code also includes an arbitrary URL/application launching primitive via xdg-open/gio/chromium-browser. That expands the capability beyond simple desktop control and can be abused to open attacker-controlled web content or trigger external handlers and applications unexpectedly.
Launching arbitrary URLs or applications is not clearly necessary from the stated purpose and materially increases the attack surface. In an agent-controlled desktop skill, this enables navigation to phishing pages, download prompts, or invocation of other registered application handlers without adequate constraint.
Opening URLs through the system default handler can launch a browser or other external application without any user-facing warning. In an agentic desktop-control setting, even non-shell execution can still cause risky side effects by delegating to trusted local applications.
No suspicious patterns detected.