Desktop Automation

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:20 PM UTC
• Version: 1.0.0

Overview

This skill is for desktop automation, but it also documents persistent always-on desktop control with broad local access and limited guardrails.

Install only on a trusted machine, prefer starting the CUA server manually when needed, avoid always-on service setup unless you fully understand the risk, keep it bound to localhost, use an auth token even locally if supported, and review the visible desktop before allowing screenshots, typing, clicks, app launches, or file/URL opens.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:53
• Finding: Persistent Always-On Desktop-Control Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 53–132 **Vulnerability Type**: Persistent startup service or scheduled task **Risk Level**: High ### Vulnerable Code ```bash ### Running as a Background Service For always-on desktop control, set up as a system service: **macOS (launchd):** ```bash # Create a plist file cat > ~/Library/LaunchAgents/com.cua.server.plist <<EOF <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>com.cua.server</string> <key>ProgramArguments</key> <array> <string>/usr/local/bin/cua-server</string> <string>start</string> <string>--port</string> <string>8000</string> </array> <key>RunAtLoad</key> <true/> <key>KeepAlive</key> <true/> </dict> </plist> EOF # Load the service launchctl load ~/Library/LaunchAgents/com.cua.server.plist # Start the service launchctl start com.cua.server ``` **Linux (systemd):** ```bash # Create service file sudo tee /etc/systemd/system/cua-server.service > /dev/null <<EOF [Unit] Description=CUA Computer Server After=network.target [Service] Type=simple User=$USER Environment="DISPLAY=:0" Environment="XAUTHORITY=/home/$USER/.Xauthority" ExecStart=/usr/local/bin/cua-server start --port 8000 Restart=always RestartSec=10 [Install] WantedBy=multi-user.target EOF # Enable and start the service sudo systemctl daemon-reload sudo systemctl enable cua-server sudo systemctl start cua-server # Check status sudo systemctl status cua-server ``` **Windows (Task Scheduler):** ```powershell # Create a scheduled task to run at startup $action = New-ScheduledTaskAction -Execute "cua-server.exe" -Argument "start --port 8000" $trigger = New-ScheduledTaskTrigger -AtStartup $principal = New-ScheduledTaskPrincipal -UserId "$env:USERNAME" -LogonType Interactive $settings = New-ScheduledTaskSe ...[truncated 3299 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove persistent service registration from the default installation procedure. 2. Start the CUA server only after an explicit user request and terminate it when the requested desktop-control operation is complete. 3. If persistent operation is genuinely required, present it as a separate, clearly disclosed opt-in configuration with an explicit warning about desktop takeover risks. 4. Require a strong, randomly generated authentication token even when binding only to localhost. 5. Restrict the listener explicitly to `127.0.0.1` and reject startup if authentication is absent. 6. Prefer per-user service management over a system-wide systemd unit; avoid `sudo` and `/etc/systemd/system` where possible. 7. Apply API authorization so clients receive only the commands needed for a specific workflow. 8. Add request logging, rate limiting, token rotation, and a visible indication that remote desktop control is active. 9. Provide complete removal procedures for every platform, including unloading and deleting the launch agent, disabling and deleting the systemd unit, and unregistering the Windows scheduled task. 10. Do not configure unconditional restart behavior unless required and explicitly approved by the user. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18
• Finding: Unpinned Third-Party Package and Source Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 18–39 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash # Install the Computer SDK pip install cua-computer-sdk # Start the server (it will control your current desktop) cua-server start --port 8000 # Or if you need to specify the display (Linux/Unix) DISPLAY=:0 cua-server start --port 8000 # Verify it's running curl http://localhost:8000/status ``` ```bash # Clone the repository git clone https://github.com/trycua/cua-computer-server cd cua-computer-server # Install dependencies pip install -r requirements.txt # Run the server python -m cua_server --port 8000 ``` ### Technical Analysis The installation instructions retrieve and install the current version of `cua-computer-sdk` without a version constraint or package hash. The alternative installation path clones the repository's mutable default branch and installs its current requirements without identifying a reviewed commit or locked, hash-verified dependency set. Consequently, the code executed by future users may differ from the code that was available when the Skill was audited. A compromised package publisher account, repository, release pipeline, or transitive dependency could introduce attacker-controlled code. Python packages can execute code during installation and subsequently when the server command is launched. The risk is amplified by the persistence instructions elsewhere in the same file. A compromised dependency could be launched automatically after installation and on future boots or logins. ### Attack Path 1. An upstream package, repository, release account, or transitive dependency is compromised or publishes a malicious update. 2. A user follows the Skill instructions and executes `pip install cua-computer-sdk`, or clones the mutable repository default branch and runs `pip install -r requirements.txt`. 3. The package manager retrieves th ...[truncated 1219 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `cua-computer-sdk` to a specifically reviewed version rather than installing the latest available release. 2. Use hash verification, such as a requirements file containing `--hash` entries and installation with `pip --require-hashes`. 3. For source installation, check out a reviewed immutable commit or signed release tag instead of using the repository's mutable default branch. 4. Publish and use a lock file that pins all direct and transitive dependencies. 5. Verify release signatures, checksums, package ownership, and repository provenance before installation. 6. Install dependencies in an isolated virtual environment under a non-administrative user. 7. Avoid running package installation commands with `sudo` or from a privileged Python environment. 8. Add dependency vulnerability and integrity scanning to the release process. 9. Re-audit pinned updates before changing the approved version or commit. 10. Ensure persistent service definitions reference the reviewed virtual-environment executable rather than an uncontrolled global executable path. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (22)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill enables highly sensitive actions such as desktop screenshots, keyboard input, app launching, and file creation/saving, but the opening description does not clearly warn users about privacy exposure, unintended data capture, or destructive system interaction. In an agent skill context, this omission increases the chance that impactful actions are invoked without informed consent or operator awareness.

Session Persistence

Medium

• Category: Rogue Agent

Content

**macOS (launchd):**
```bash
# Create a plist file
cat > ~/Library/LaunchAgents/com.cua.server.plist <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

• Confidence: 84% confidence
• Finding: The macOS launchd plist instructions establish auto-start behavior for a desktop-control server, creating persistent access to desktop automation capabilities. Persistent background availability magnifies the risk of unauthorized screenshots or input injection if the service is misconfigured or exposed.

Session Persistence

Medium

• Category: Rogue Agent

Content

**macOS (launchd):**
```bash
# Create a plist file
cat > ~/Library/LaunchAgents/com.cua.server.plist <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

**macOS (launchd):**
```bash
# Create a plist file
cat > ~/Library/LaunchAgents/com.cua.server.plist <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

**macOS (launchd):**
```bash
# Create a plist file
cat > ~/Library/LaunchAgents/com.cua.server.plist <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

**macOS (launchd):**
```bash
# Create a plist file
cat > ~/Library/LaunchAgents/com.cua.server.plist <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Create a plist file
cat > ~/Library/LaunchAgents/com.cua.server.plist <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

EOF

# Load the service
launchctl load ~/Library/LaunchAgents/com.cua.server.plist

# Start the service
launchctl start com.cua.server

• Confidence: 90% confidence
• Finding: Loading the LaunchAgent with launchctl activates persistent background execution of the desktop-control server for the current user. Because this server can capture screenshots and drive input, persistent activation meaningfully increases the likelihood and duration of misuse.

Session Persistence

Medium

• Category: Rogue Agent

Content

EOF

# Load the service
launchctl load ~/Library/LaunchAgents/com.cua.server.plist

# Start the service
launchctl start com.cua.server

• Confidence: 90% confidence
• Finding: Loading the LaunchAgent with launchctl activates persistent background execution of the desktop-control server for the current user. Because this server can capture screenshots and drive input, persistent activation meaningfully increases the likelihood and duration of misuse.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Linux (systemd):**
```bash
# Create service file
sudo tee /etc/systemd/system/cua-server.service > /dev/null <<EOF
[Unit]
Description=CUA Computer Server

• Confidence: 88% confidence
• Finding: Creating a systemd service file is a persistence mechanism that turns this desktop-control capability into a background service. Given the skill's powerful ability to observe and control the host desktop, persistence substantially raises abuse potential.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Linux (systemd):**
```bash
# Create service file
sudo tee /etc/systemd/system/cua-server.service > /dev/null <<EOF
[Unit]
Description=CUA Computer Server
After=network.target

• Confidence: 87% confidence
• Finding: The documentation instructs users to write a systemd service file under /etc using sudo, establishing a privileged system-level configuration for persistent desktop control. Although this is framed as setup guidance, it increases attack surface and trust in a local service that can control user input and observe the desktop.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

EOF

# Enable and start the service
sudo systemctl daemon-reload
sudo systemctl enable cua-server
sudo systemctl start cua-server

• Confidence: 82% confidence
• Finding: Running systemctl management commands with sudo for this service requires elevated privileges and encourages privileged deployment of a component that can automate desktop interaction. If the server or configuration is compromised, persistence and control become more impactful.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Enable and start the service
sudo systemctl daemon-reload
sudo systemctl enable cua-server
sudo systemctl start cua-server

# Check status

• Confidence: 82% confidence
• Finding: Enabling and starting the service with sudo contributes both privileged execution and persistence for a desktop-control server. This is risky because it makes an automation endpoint continuously available and harder for users to notice or constrain.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Enable and start the service
sudo systemctl daemon-reload
sudo systemctl enable cua-server
sudo systemctl start cua-server

# Check status

• Confidence: 92% confidence
• Finding: Using systemctl enable makes the desktop-control server persistent across reboots, creating a long-lived automation endpoint capable of screenshots, input injection, launching apps, and file interaction. Persistence materially increases impact because compromise or misuse no longer depends on a one-time manual launch.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Enable and start the service
sudo systemctl daemon-reload
sudo systemctl enable cua-server
sudo systemctl start cua-server

# Check status
sudo systemctl status cua-server

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo systemctl start cua-server

# Check status
sudo systemctl status cua-server
```

**Windows (Task Scheduler):**

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

curl http://localhost:8000/commands | jq

# Take a test screenshot of your desktop
curl -X POST http://localhost:8000/cmd \
  -H "Content-Type: application/json" \
  -d '{"command": "screenshot"}' \
  | jq -r '.result.base64' \

• Confidence: 84% confidence
• Finding: This example transmits a screenshot over HTTP from the desktop-control server, which can expose sensitive on-screen content such as credentials, messages, documents, or tokens. Even though the destination is localhost by default, the skill is specifically designed to extract and serialize desktop contents, so the data exposure risk is real if misused or if the server is remotely exposed.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Permission Denied (Linux):**
```bash
# You may need to add your user to the input group for keyboard/mouse control
sudo usermod -a -G input $USER
# Log out and back in for changes to take effect
```

• Confidence: 78% confidence
• Finding: The skill instructs users to modify group membership with sudo to gain access to input devices, expanding the process's ability to inject keyboard and mouse events. This broadens the skill's capabilities and increases host compromise potential if the server is abused.

External Transmission

Medium

• Category: Data Exfiltration

Content

Capture the current screen:
```bash
curl -X POST http://localhost:8000/cmd \
  -H "Content-Type: application/json" \
  -d '{"command": "screenshot"}' \
  | jq -r '.result.base64' \

• Confidence: 83% confidence
• Finding: The screenshot command explicitly captures desktop contents and writes them to a file, creating a local data extraction path for sensitive visual information. In this skill's context, that is a core capability rather than an incidental network call, so the transmission and storage of sensitive information is a genuine security concern.

External Transmission

Medium

• Category: Data Exfiltration

Content

Click at specific x,y coordinates:
```bash
# Click at center of 1280x720 screen
curl -X POST http://localhost:8000/cmd \
  -H "Content-Type: application/json" \
  -d '{"command": "left_click", "params": {"x": 640, "y": 360}}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Get Screen Size
```bash
curl -X POST http://localhost:8000/cmd \
  -H "Content-Type: application/json" \
  -d '{"command": "get_screen_size"}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The example usage implies that user requests like taking screenshots, opening Firefox, typing text, or clicking the screen are automatically executed, without any confirmation step for sensitive or system-impacting operations. This is dangerous because such examples normalize silent execution of commands that can expose private data or alter system/application state.

Static analysis

No suspicious patterns detected.