Smseow Peekaboo

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.0.2

Overview

This desktop-control skill is not deceptive, but it needs careful review because it tells users to run unpinned third-party tools that can view and control the desktop.

Install only if you intentionally want an agent to see your screen and automate clicks or typing. Pin and verify the third-party packages or repositories before running them, grant desktop permissions only after review, avoid using it around passwords or sensitive sessions, and revoke Accessibility/screen permissions when finished.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Third-Party Desktop-Control Dependencies Are Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–38, 65–68, 73–74, and 84–86
Vulnerability Type: Unpinned and automatically executed third-party dependencies
Risk Level: Medium

Vulnerable Code Snippets

macOS package installation and permission grant, lines 35–38:

bash

npx -y @steipete/peekaboo

# 授权
peekaboo permissions grant

Linux Python package installation and execution, lines 65–68:

bash

# 安装
pip install mcp-desktop-control

# 运行
mcp-desktop-control

Linux Node.js package installation and execution, lines 73–74:

bash

# 安装运行
npx -y mcp-desktop-pro serve

Git repository retrieval and direct execution, lines 84–86:

bash

git clone https://github.com/bhyoo/kwin-mcp
cd kwin-mcp
python kwin-mcp.py

Technical Analysis

The documented commands download and execute third-party packages or repository content without pinning an exact package version or Git commit. The npx -y option also suppresses installation confirmation and immediately executes the package selected by the registry. The pip installation accepts the repository's current unconstrained release, while the Git workflow executes code from the current default branch.

Consequently, the code that ultimately runs can change after this Skill has been reviewed. Compromise of an upstream maintainer account, package registry, release process, dependency chain, or Git repository could cause users to retrieve and execute attacker-controlled code.

The affected components provide desktop-automation functions such as screen capture, mouse control, keyboard input, and application interaction. The macOS workflow additionally directs the user to grant accessibility permissions. This makes supply-chain compromise particularly sensitive because a malicious dependency may inherit both the invoking user's privileges and security-relevant desktop-control access.

There is no evidence that the named packages or repository are currently malicious. The finding ...[truncated 1548 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every package to an exact, reviewed version:
   • Use @steipete/peekaboo@X.Y.Z.
   • Use mcp-desktop-pro@X.Y.Z.
   • Use mcp-desktop-control==X.Y.Z.
2. Pin Git-hosted code to a reviewed commit hash rather than executing the current default branch.
3. Verify downloaded artifacts using trusted checksums, lockfiles, provenance attestations, or cryptographic signatures.
4. Avoid npx -y for security-sensitive desktop-control tools. Separate package retrieval, integrity verification, and execution into explicit steps.
5. Document the authoritative registry namespace and repository for each dependency to reduce dependency-confusion and typosquatting risk.
6. Review direct and transitive dependencies before deployment and use automated dependency and provenance scanning.
7. Grant accessibility, screen-recording, and input-control permissions only after verifying the installed artifact.
8. Run desktop-control components under a dedicated least-privileged account or sandbox where practical.
9. Revoke desktop-control permissions when the functionality is no longer required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill markets screen viewing and desktop manipulation without prominently warning about privacy, credential exposure, destructive clicks, or unintended system interaction. Given the powerful capabilities described, missing safety boundaries increases the chance that users will enable invasive automation without understanding the risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad and overlap with normal user requests such as taking screenshots or controlling the desktop, making accidental invocation more likely. In a skill that can observe the screen and inject input, unintended activation can lead to privacy exposure or unsafe actions on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs users to execute an unpinned package directly via npx, which fetches and runs the latest published code at execution time. In a desktop-control skill, that creates a significant supply-chain risk because compromised or malicious updates could immediately gain screen access, input automation capability, or broader user-context execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This command runs an unpinned npm package directly from the registry, exposing users to arbitrary code changes on every install or launch. Because the package is meant to control the desktop, a hostile update could capture screenshots, simulate clicks/keystrokes, or exfiltrate sensitive data with the user's privileges.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

export DISPLAY=localhost:0

安装依赖

sudo apt install python3-xlib flameshot scrot

text

### 3. Python 自动化

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The description includes "(Simon专属)", indicating the skill is intended only for a specific named user. This is a natural-language usage restriction without any documented opt-in, configurable access model, or clear justification in the file.

Content

No source excerpt is available for this finding.

Rp1

Low

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

An unpinned pip install introduces a supply-chain risk by allowing future package changes to alter what gets installed. Although this is a common documentation pattern, it is risky here because the installed software is intended to automate desktop interaction and may handle sensitive on-screen data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.