Windows Control

• Outcome: Review
• Latest audit: Jul 10, 2026 · 6:44 AM UTC
• Version: 1.0.0

Overview

The skill appears to do what it claims, but it gives an agent broad Windows desktop control and screen-reading ability without strong built-in safeguards.

Install only if you intentionally want an agent to control and read your Windows desktop. Use it in a controlled environment or with explicit per-action review, avoid sensitive apps such as password managers, banking, email, admin consoles, and private browser sessions, and require confirmation before screenshots, form-value reads, dialog clicks, file saves, closes, or any action that could submit, delete, overwrite, or approve something.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly grants full desktop control and broad content-reading abilities, which can access arbitrary applications, files, browser sessions, and on-screen secrets. Without prominent warnings, scope limits, or consent requirements, users or downstream agents may invoke it in ways that expose sensitive data or perform destructive actions across the entire Windows session.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documented read_window, read_ui_elements, and read_webpage capabilities can extract text, links, UI structure, and browser content from active applications, which may include credentials, personal data, confidential documents, or internal web apps. Presenting these features as routine utility without a clear privacy warning increases the risk of silent data collection or overbroad exfiltration by an agent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The dialog-handling, close/save, and automation examples can confirm prompts, overwrite files, dismiss warnings, or close applications, potentially causing irreversible state changes or data loss. Because the documentation frames these actions as normal automation flows without cautionary guidance, an agent may perform risky confirmations or file operations without adequate human review.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The manifest advertises unrestricted 'full Windows desktop control' with mouse, keyboard, and screenshot capabilities, but provides no trigger boundaries, consent requirements, or task-scoping constraints. In an agent skill, this ambiguity is dangerous because it normalizes broad OS-level interaction that could be used to access sensitive applications, capture secrets, or perform unintended actions outside the user's expectations.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The package manifest explicitly promotes full desktop control and screenshot capture but omits any warning that the skill can interact with arbitrary Windows applications and collect potentially sensitive on-screen data. Given the skill context, these capabilities are inherently high risk because they can enable credential theft, data exfiltration, destructive system actions, or covert surveillance if invoked improperly or abused by an agent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This script performs UI clicks on matched controls with no safety boundary, confirmation, allowlist, or restriction to benign applications. In a skill explicitly designed for full Windows desktop control, clicking the wrong or attacker-influenced element can confirm security prompts, delete data, launch software, alter settings, or approve privileged actions across arbitrary applications.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script performs an immediate OS-level mouse click on whatever UI element contains the requested text, without any pre-action confirmation, allowlist, or verification that the matched control is the intended target. In a skill explicitly designed for full Windows desktop control, this can trigger destructive or sensitive actions such as approving prompts, sending messages, dismissing security dialogs, or interacting with the wrong application if text matching is ambiguous.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script enumerates dialog controls and prints dialog titles, messages, button labels, and field values directly to stdout or JSON. In a full desktop-control skill, dialogs commonly contain sensitive data such as file paths, document names, prompts, email subjects, authentication challenges, or secret values, so this creates a clear screen/content exfiltration path without consent checks or redaction.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The function can focus a dialog field and inject arbitrary keystrokes into the first enabled Edit/ComboBox control, which can alter file names, destinations, prompts, or other application state. In a desktop automation skill, this enables unintended or unauthorized modification of live application workflows, especially because it defaults to active dialogs and has no confirmation, policy check, or target validation.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The dismiss logic automatically tries common buttons such as OK, Yes, Accept, and Done, then falls back to sending Escape, without understanding the semantic effect of the dialog. In a full Windows control context, this can confirm destructive prompts, overwrite files, accept security warnings, or close critical alerts, making unintended irreversible actions likely.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: When run with --full, the script reads values from Edit and ComboBox controls and includes them in output, which can expose secrets such as passwords, tokens, search queries, personal data, or form contents from the active browser window. In the context of a 'full Windows desktop control' skill, this is especially dangerous because it enables easy collection and exfiltration of sensitive data from arbitrary web sessions without any warning, consent check, masking, or field-type filtering.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This script enumerates UI descendants of an arbitrary window title and prints all discovered text to stdout, which can expose sensitive on-screen data such as emails, chats, documents, tokens, or other application content. In the context of a skill explicitly designed for full Windows desktop control, this capability materially increases privacy and data-exfiltration risk because it enables broad reading of user-visible content across applications without any consent check, scope restriction, or warning.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This script captures the full screen and exports it as base64 without any user-facing notice, consent check, scope limitation, or redaction. In a skill explicitly designed for full Windows desktop control, screenshots can expose highly sensitive information such as passwords, email contents, documents, tokens, or regulated data, making silent capture materially dangerous.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.