Desktop Automation

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:20 PM UTC
• Version: 1.0.0

Overview

This skill is for desktop automation, but it also documents persistent always-on desktop control with broad local access and limited guardrails.

Install only on a trusted machine, prefer starting the CUA server manually when needed, avoid always-on service setup unless you fully understand the risk, keep it bound to localhost, use an auth token even locally if supported, and review the visible desktop before allowing screenshots, typing, clicks, app launches, or file/URL opens.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:53

Finding

Persistent Always-On Desktop-Control Service

Content

View full analysis

~/Library/LaunchAgents/com.cua.server.plist < Label com.cua.server ProgramArguments /usr/local/bin/cua-server start --port 8000 RunAtLoad KeepAlive EOF # Load the service launchctl load ~/Library/LaunchAgents/com.cua.server.plist # Start the service launchctl start com.cua.server ``` **Linux (systemd):** ```bash # Create service file sudo tee /etc/systemd/system/cua-server.service > /dev/null <

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Third-Party Package and Source Dependencies

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (22)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill enables highly sensitive actions such as desktop screenshots, keyboard input, app launching, and file creation/saving, but the opening description does not clearly warn users about privacy exposure, unintended data capture, or destructive system interaction. In an agent skill context, this omission increases the chance that impactful actions are invoked without informed consent or operator awareness.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The macOS launchd plist instructions establish auto-start behavior for a desktop-control server, creating persistent access to desktop automation capabilities. Persistent background availability magnifies the risk of unauthorized screenshots or input injection if the service is misconfigured or exposed.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

macOS (launchd):

bash

# Create a plist file
cat > ~/Library/LaunchAgents/com.cua.server.plist <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

macOS (launchd):

bash

# Create a plist file
cat > ~/Library/LaunchAgents/com.cua.server.plist <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

macOS (launchd):

bash

# Create a plist file
cat > ~/Library/LaunchAgents/com.cua.server.plist <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

macOS (launchd):

bash

# Create a plist file
cat > ~/Library/LaunchAgents/com.cua.server.plist <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

macOS (launchd):

bash

# Create a plist file
cat > ~/Library/LaunchAgents/com.cua.server.plist <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md

# Create a plist file
cat > ~/Library/LaunchAgents/com.cua.server.plist <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Loading the LaunchAgent with launchctl activates persistent background execution of the desktop-control server for the current user. Because this server can capture screenshots and drive input, persistent activation meaningfully increases the likelihood and duration of misuse.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

EOF

# Load the service
launchctl load ~/Library/LaunchAgents/com.cua.server.plist

# Start the service
launchctl start com.cua.server

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Loading the LaunchAgent with launchctl activates persistent background execution of the desktop-control server for the current user. Because this server can capture screenshots and drive input, persistent activation meaningfully increases the likelihood and duration of misuse.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

EOF

# Load the service
launchctl load ~/Library/LaunchAgents/com.cua.server.plist

# Start the service
launchctl start com.cua.server

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Creating a systemd service file is a persistence mechanism that turns this desktop-control capability into a background service. Given the skill's powerful ability to observe and control the host desktop, persistence substantially raises abuse potential.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

Linux (systemd):

bash

# Create service file
sudo tee /etc/systemd/system/cua-server.service > /dev/null <<EOF
[Unit]
Description=CUA Computer Server

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The documentation instructs users to write a systemd service file under /etc using sudo, establishing a privileged system-level configuration for persistent desktop control. Although this is framed as setup guidance, it increases attack surface and trust in a local service that can control user input and observe the desktop.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

Linux (systemd):

bash

# Create service file
sudo tee /etc/systemd/system/cua-server.service > /dev/null <<EOF
[Unit]
Description=CUA Computer Server
After=network.target

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

Running systemctl management commands with sudo for this service requires elevated privileges and encourages privileged deployment of a component that can automate desktop interaction. If the server or configuration is compromised, persistence and control become more impactful.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

EOF

# Enable and start the service
sudo systemctl daemon-reload
sudo systemctl enable cua-server
sudo systemctl start cua-server

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

Enabling and starting the service with sudo contributes both privileged execution and persistence for a desktop-control server. This is risky because it makes an automation endpoint continuously available and harder for users to notice or constrain.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

# Enable and start the service
sudo systemctl daemon-reload
sudo systemctl enable cua-server
sudo systemctl start cua-server

# Check status

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

Using systemctl enable makes the desktop-control server persistent across reboots, creating a long-lived automation endpoint capable of screenshots, input injection, launching apps, and file interaction. Persistence materially increases impact because compromise or misuse no longer depends on a one-time manual launch.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

# Enable and start the service
sudo systemctl daemon-reload
sudo systemctl enable cua-server
sudo systemctl start cua-server

# Check status

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md

# Enable and start the service
sudo systemctl daemon-reload
sudo systemctl enable cua-server
sudo systemctl start cua-server

# Check status
sudo systemctl status cua-server

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

sudo systemctl start cua-server

Check status

sudo systemctl status cua-server

text

**Windows (Task Scheduler):**

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

This example transmits a screenshot over HTTP from the desktop-control server, which can expose sensitive on-screen content such as credentials, messages, documents, or tokens. Even though the destination is localhost by default, the skill is specifically designed to extract and serialize desktop contents, so the data exposure risk is real if misused or if the server is remotely exposed.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

curl http://localhost:8000/commands | jq

# Take a test screenshot of your desktop
curl -X POST http://localhost:8000/cmd \
  -H "Content-Type: application/json" \
  -d '{"command": "screenshot"}' \
  | jq -r '.result.base64' \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The skill instructs users to modify group membership with sudo to gain access to input devices, expanding the process's ability to inject keyboard and mouse events. This broadens the skill's capabilities and increases host compromise potential if the server is abused.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

Permission Denied (Linux):

bash

# You may need to add your user to the input group for keyboard/mouse control
sudo usermod -a -G input $USER
# Log out and back in for changes to take effect

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The screenshot command explicitly captures desktop contents and writes them to a file, creating a local data extraction path for sensitive visual information. In this skill's context, that is a core capability rather than an incidental network call, so the transmission and storage of sensitive information is a genuine security concern.

Content

Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.

Capture the current screen:

bash

curl -X POST http://localhost:8000/cmd \
  -H "Content-Type: application/json" \
  -d '{"command": "screenshot"}' \
  | jq -r '.result.base64' \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

Click at specific x,y coordinates:

bash

# Click at center of 1280x720 screen
curl -X POST http://localhost:8000/cmd \
  -H "Content-Type: application/json" \
  -d '{"command": "left_click", "params": {"x": 640, "y": 360}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 474)May include surrounding context.

Get Screen Size

bash

curl -X POST http://localhost:8000/cmd \
  -H "Content-Type: application/json" \
  -d '{"command": "get_screen_size"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example usage implies that user requests like taking screenshots, opening Firefox, typing text, or clicking the screen are automatically executed, without any confirmation step for sensitive or system-impacting operations. This is dangerous because such examples normalize silent execution of commands that can expose private data or alter system/application state.

Content

No source excerpt is available for this finding.