GUI Automation

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:57 PM UTC
• Version: 1.0.1

Overview

This skill openly enables desktop control, but it relies on an unauthenticated local control API and unpinned third-party installation steps for a high-impact desktop server.

Install only if you intentionally want OpenClaw and any process able to reach the local server to control your desktop. Prefer a pinned, reviewed server version in an isolated environment, bind explicitly to 127.0.0.1, avoid background operation and sudo group changes unless necessary, and stop the server when finished.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:24
• Finding: Unpinned Installation of a High-Privilege Third-Party Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:24-27` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: High ### Vulnerable Code ```bash # Install the Computer SDK (official CUA package) pip install cua-computer-sdk # Verify package (optional but recommended) pip show cua-computer-sdk # Check publisher and version ``` ### Technical Analysis The installation command retrieves and installs the latest available version of `cua-computer-sdk` without a version constraint, lockfile, package hash, or signature verification. The subsequent `pip show` command only displays installed package metadata; it does not establish publisher authenticity or verify package integrity. This dependency is especially sensitive because the installed server receives the ability to capture screenshots, generate keyboard and mouse input, launch applications, and open files under the current user's privileges. A compromised package release, package-index account, or transitive dependency could therefore execute arbitrary code with access to the user's desktop session. ### Attack Path 1. An attacker compromises the package, its publisher account, distribution process, or an unpinned transitive dependency. 2. A malicious release becomes the version selected by `pip install cua-computer-sdk`. 3. The user follows the documented installation command. 4. Malicious installation hooks, imported modules, or server startup code execute with the user's privileges. 5. The attacker can access user-readable data, monitor the desktop, manipulate applications, or execute additional user-level actions. ### Impact Assessment Successful exploitation provides code execution with the privileges of the user installing or running the package. The affected scope can include the user's files, environment variables, browser session, visible confidential information, clipboard contents, and applications accessible from the active desktop session. The do ...[truncated 234 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specifically reviewed version: ```bash python -m pip install "cua-computer-sdk==<reviewed-version>" ``` 2. Publish a requirements or lock file containing cryptographic hashes, and install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Verify the package artifact against a hash distributed through an independent trusted channel. 4. Review and pin all transitive dependencies rather than only the top-level package. 5. Install the server in a dedicated virtual environment or isolated desktop environment. 6. Document the expected publisher, package index, version, and artifact hash. Do not describe `pip show` as an integrity check. 7. Periodically review pinned versions for known vulnerabilities before updating them. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:35
• Finding: Mutable Source Checkout and Unpinned Source Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:35-45` **Vulnerability Type**: Unsafe source and dependency installation **Risk Level**: High ### Vulnerable Code ```bash # Clone and review the code first git clone https://github.com/trycua/cua-computer-server cd cua-computer-server # Review the code before running ls -la cat requirements.txt # Check dependencies # Install and run pip install -r requirements.txt python -m cua_server --port 8000 --bind 127.0.0.1 ``` ### Technical Analysis The alternative installation procedure clones the repository's mutable default branch without selecting a reviewed commit or signed release. It then installs the repository's dependency list without requiring locked versions or cryptographic hashes. Displaying `requirements.txt` does not verify the integrity or safety of its packages. The effective code and dependency set can change after the skill itself has been reviewed, making the installation non-reproducible and exposing users to upstream repository and dependency compromise. ### Attack Path 1. An attacker compromises the upstream repository, maintainer account, release process, or one of the dependencies referenced by `requirements.txt`. 2. The mutable default branch or dependency resolution results are changed to contain malicious code. 3. A user follows the documented `git clone` and `pip install -r requirements.txt` procedure. 4. The altered package installation or server startup code executes under the user's account. 5. The malicious component abuses the server's desktop access or performs arbitrary actions available to the user. ### Impact Assessment Exploitation can result in user-level arbitrary code execution. Because the software is intended to control the desktop, the exposed scope includes screenshots, keyboard and mouse operations, local applications, user-readable files, browser sessions, and other resources available to the account. No evidence establishes administrative privile ...[truncated 148 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the mutable default-branch checkout with a reviewed commit or signed release: ```bash git clone https://github.com/trycua/cua-computer-server cd cua-computer-server git checkout --detach <reviewed-commit-sha> ``` 2. Verify the selected commit or release using a trusted signature or independently published checksum. 3. Supply a dependency lockfile with exact versions and cryptographic hashes. 4. Install dependencies using hash enforcement: ```bash python -m pip install --require-hashes -r requirements.lock ``` 5. Review installation hooks, build configuration, server entry points, and all dependency changes before approving a new commit. 6. Run the server in an isolated user account, container, virtual machine, or disposable desktop session with access only to required resources. 7. Document a controlled update process so users do not silently move to unreviewed upstream code. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:118
• Finding: Desktop-Control API Requests Lack Authentication<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:118-122` **Additional Relevant Locations**: `SKILL.md:145-148`, `SKILL.md:230-240` **Vulnerability Type**: Unauthenticated high-impact local control API **Risk Level**: High ### Vulnerable Code ```bash curl -X POST http://localhost:8000/cmd \ -H "Content-Type: application/json" \ -d '{"command": "screenshot"}' \ -o screenshot.json ``` Related documented commands also omit authentication: ```bash curl -X POST http://localhost:8000/cmd \ -H "Content-Type: application/json" \ -d '{"command": "hotkey", "params": {"keys": ["ctrl", "alt", "t"]}}' ``` ```bash # Launch Firefox curl -X POST http://localhost:8000/cmd \ -H "Content-Type: application/json" \ -d '{"command": "launch", "params": {"app": "firefox"}}' # Launch Terminal curl -X POST http://localhost:8000/cmd \ -H "Content-Type: application/json" \ -d '{"command": "launch", "params": {"app": "xfce4-terminal"}}' ``` ### Technical Analysis The documented API requests contain no bearer token, session credential, request signature, or other authentication mechanism. The endpoint exposes operations capable of taking screenshots, generating keyboard input, controlling the pointer, launching applications, opening files or URLs, and manipulating windows. Binding the service to `127.0.0.1` reduces remote network exposure but is not an authentication boundary. Other processes running locally—and potentially other local users, depending on host isolation and server behavior—may be able to connect to the loopback endpoint. If the service is accidentally bound to a non-loopback interface, the same unauthenticated functionality may become remotely reachable. The documentation is also inconsistent: the recommended installation command explicitly binds to `127.0.0.1`, while a later manual-start example uses only `cua-server start --port 8000`. The actual default binding is not established by the audited file, so relying on it creates a ...[truncated 1547 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require a cryptographically random, per-session bearer token for every status, command, and discovery endpoint. 2. Generate the token at server startup, keep it in a user-readable-only file or protected environment variable, and never include it in logs. 3. Reject all requests without valid authentication before parsing or executing commands. 4. Add request rate limiting, command auditing, and explicit allowlists for permitted operations. 5. Bind explicitly to `127.0.0.1` in every startup example: ```bash cua-server start --port 8000 --bind 127.0.0.1 ``` 6. Fail securely if a non-loopback bind is requested unless transport encryption, authentication, and explicit user confirmation are configured. 7. Consider a Unix-domain socket with restrictive filesystem permissions instead of a TCP listener on supported systems. 8. Apply strict browser-origin and cross-origin request protections if the API can receive browser-generated requests. 9. Run the service under a dedicated, minimally privileged account or inside an isolated disposable desktop environment. 10. Add user confirmation for sensitive operations such as screenshots, terminal launch, file opening, credential entry, form submission, and destructive UI actions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

This skill:
- ✅ Controls YOUR desktop when the server is running
- ✅ Runs with YOUR user privileges (no admin/sudo needed)
- ✅ Only accessible from localhost by default

## Security Best Practices

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Simple health check
curl http://localhost:8000/status
# Should return: {"status": "ok"}

# Take a screenshot (safe test)

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Permission Denied (Linux):**
```bash
# You may need to add your user to the input group for keyboard/mouse control
sudo usermod -a -G input $USER
# Log out and back in for changes to take effect
```

• Confidence: 84% confidence
• Finding: The troubleshooting guidance instructs the user to run a sudo command that changes group membership, which requires elevated privileges and expands the account's ability to generate input events. In a desktop automation context, this increases the blast radius of misuse and normalizes privilege escalation in setup instructions.

External Transmission

Medium

• Category: Data Exfiltration

Content

Capture the current screen:
```bash
curl -X POST http://localhost:8000/cmd \
  -H "Content-Type: application/json" \
  -d '{"command": "screenshot"}' \
  | jq -r '.result.base64' \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Click at specific x,y coordinates:
```bash
# Click at center of 1280x720 screen
curl -X POST http://localhost:8000/cmd \
  -H "Content-Type: application/json" \
  -d '{"command": "left_click", "params": {"x": 640, "y": 360}}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Get Screen Size
```bash
curl -X POST http://localhost:8000/cmd \
  -H "Content-Type: application/json" \
  -d '{"command": "get_screen_size"}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The example utterances are broad imperative phrases like taking screenshots, opening apps, typing text, and clicking the screen. In a skill that exposes direct desktop-control primitives, such generic invocation language increases the chance of accidental or insufficiently confirmed execution during ordinary conversation, which can trigger unintended UI actions and data exposure.

Natural-Language Policy Violations

Low

• Confidence: 1% confidence
• Finding: No natural-language strings in the file appear to require a specific language or locale. Because SQP-3 is limited here to language/locale policy violations, this file does not contain a genuine violation.

Static analysis

No suspicious patterns detected.