Security audit

Windows Control

Security checks for vulnerabilities and agentic risk

Overview

This is a real Windows desktop-control skill, but it gives an agent broad ability to read screens and click, type, or close things across apps without built-in confirmation or privacy boundaries.

Install only if you intend to let the agent control your Windows desktop. Close or minimize sensitive apps first, avoid using it around passwords or private browser sessions, and require explicit confirmation before screenshots, browser/window reads, dialog dismissal, closing windows, or clicks on actions like Send, Delete, Save, Yes, Allow, or Accept.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared description advertises broad Windows desktop automation capabilities: mouse, keyboard, screenshots, and general app interaction. The supplied code chunk implements a much narrower function: focusing an existing window by title. While window focusing is related to desktop interaction, it does not substantiate the claimed full-control capability set. This is a description-to-behavior mismatch because the actual code's primary purpose is substantially narrower than the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description claims broad Windows desktop control capabilities, including input automation and screenshots. The supplied code performs a much narrower read-only action: it queries the active window and outputs its title. This is a materially different primary behavior from full desktop control, so the description does not accurately represent the actual code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The description overstates the skill substantially. The supplied code only handles Windows dialogs: listing them, reading their contents, clicking buttons, typing into dialog fields, dismissing them, and waiting for dialogs to appear. It does not provide full desktop control, does not capture screenshots, and does not support arbitrary interaction with any Windows application beyond dialog-focused automation. This is a materially narrower primary purpose than declared.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description advertises broad desktop automation and control capabilities, but the code chunk performs only a narrow read-only task: listing open windows and their basic state. This is a materially different and much more limited primary purpose than 'full Windows desktop control.' While window enumeration could support a larger automation system, the provided code does not implement the declared interaction capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description broadly advertises comprehensive Windows desktop interaction capabilities, but the code chunk implements a narrow single-purpose action: locating a window by title and maximizing it. This is a materially different and much more limited behavior than the declared purpose. While maximizing a window is loosely related to desktop control, the claimed capabilities of mouse, keyboard, screenshots, and interaction with any application are not represented in this code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description is much broader than the supplied code. While minimizing a window is loosely within Windows UI control, this specific code chunk implements only a narrow window-management action: locating a window by title and minimizing it. It does not provide mouse input, keyboard input, screenshots, or general interaction with arbitrary Windows applications as described. Therefore the description does not accurately represent the actual behavior of this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description promises a broad remote-control capability for the Windows desktop: mouse input, keyboard input, screenshots, and human-like interaction with any application. The supplied code only takes screen coordinates, captures that region via screenshot, and optionally runs OCR to read text. While screenshotting is loosely related to the declared scope, the primary behavior is narrow screen-text extraction rather than full desktop control. Key advertised capabilities such as mouse control, keyboard control, and general application interaction are absent, so the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description advertises broad active control of the Windows desktop, including mouse, keyboard, screenshots, and interaction with any application. The provided code is read-only introspection: it scans a selected window's UI automation tree and reports interactive elements and their bounds. While the extracted coordinates could support later clicking, this chunk itself does not click, type, capture screens, or otherwise control the desktop. The actual primary purpose is UI element discovery, which is materially narrower than the declared full-control capability.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises broad desktop control and interaction capabilities across any Windows application, including mouse, keyboard, and screenshots. The supplied code does not implement any of those functions. Instead, it passively locates a browser window and extracts accessible UI text and element metadata from it. Its primary purpose is browser webpage content reading, not full desktop control. This is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description promises broad interactive desktop automation capabilities: controlling mouse and keyboard, taking screenshots, and interacting with any Windows application. The supplied code does not implement any of those core behaviors. Instead, it performs a much narrower, read-only task: locating a window by title and extracting text from its descendant controls. This is a materially different primary purpose and substantially less capable than advertised. There are no hidden extra capabilities beyond the description; the mismatch is that the description overstates functionality compared with the actual code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description advertises broad desktop automation capabilities: mouse control, keyboard input, screenshots, and human-like interaction with any Windows application. The supplied code chunk implements only a screenshot function. While screenshot capture is one subset of the declared behavior, the code does not provide the other core capabilities claimed in the description. This is a material description-to-behavior mismatch because the declared primary purpose is much broader than the actual implemented behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description promises broad Windows desktop control with interactive capabilities such as mouse, keyboard, and screenshots. The supplied code does none of these. It only reads UI text from windows using pywinauto, polling until a target string appears. This is a materially different and much narrower purpose than full desktop control, so the description does not accurately represent the code's actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a broad Windows desktop automation/control skill, but this code chunk implements a narrow utility: detecting whether a window with a matching title exists within a timeout. It does not perform input control, screenshots, or general interaction with applications. This is a materially different and much narrower behavior than the declared purpose, so the description does not accurately represent the supplied code chunk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly enables screenshots and window-reading across arbitrary applications, which can expose passwords, tokens, personal messages, financial data, and other sensitive on-screen content. Because the documentation lacks an explicit warning or usage boundary, operators may invoke it in contexts where confidential data is captured or exfiltrated without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The text and webpage extraction commands are designed to read browser and application-window contents, which can include emails, chats, documents, account data, session information, or internal web apps. In the context of a desktop-control skill, omission of a privacy warning is more dangerous because the capability is broad, low-friction, and easily applicable to unrelated applications beyond the intended task.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Dialog automation that clicks buttons like 'OK', 'Save', 'Yes', or auto-dismisses prompts can trigger destructive or irreversible actions such as overwriting files, confirming deletions, accepting security prompts, or closing unsaved work. The examples normalize these actions without warning about verification or context checks, increasing the likelihood of unintended harmful operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest explicitly markets unrestricted Windows desktop control, mouse/keyboard interaction, and screenshots, but provides no warning about privacy, credential exposure, destructive system actions, or the need for explicit user consent. For a capability this powerful, omission of user-facing risk disclosure increases the chance of unsafe deployment and misuse, especially because the description frames broad host access as a feature.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script performs a real mouse click on the first control whose visible text partially matches untrusted user input, with no confirmation, uniqueness check, or verification that the matched control is the intended target. In a skill explicitly designed for full Windows desktop control, this can misfire onto security-sensitive UI elements such as 'Delete', 'Send', 'Allow', or 'OK', causing unintended actions across arbitrary applications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script closes any window whose title contains a user-supplied substring without any confirmation, allowlist, or safety checks. In a skill explicitly designed for full Windows desktop control, this can terminate arbitrary applications or dialogs, potentially causing data loss, interrupting security prompts, or disrupting active user workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The dismiss action blindly tries a broad set of button labels including 'Yes' and 'No', then falls back to sending Escape, without verifying the dialog type, semantic meaning, or whether the action is safe. In a full Windows desktop control skill, this can confirm destructive prompts such as deleting files, discarding work, overwriting data, accepting security warnings, or closing applications, causing unintended state changes and data loss.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This script enumerates UI elements from any window whose title partially matches user input and prints element names, text, and coordinates directly to stdout. In a skill whose purpose is full desktop control, that can expose sensitive on-screen data from unrelated applications, including document contents, browser pages, dialogs, or internal app state, with no consent check, scoping, or redaction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This script enumerates browser UI elements and extracts visible text, link metadata, and, in full mode, input field values from whatever browser window it finds. In a 'windows-control' skill with broad desktop access, that can expose sensitive data such as session content, personal messages, internal documents, search queries, and form contents without any consent check, domain restriction, redaction, or privacy warning.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This script enumerates a target window's descendants and prints all visible text content to stdout, which can expose sensitive on-screen data such as emails, tokens, chat messages, or document contents. In a 'windows-control' skill, this capability is especially sensitive because it enables broad desktop scraping without any consent check, scope restriction, redaction, or warning to the user.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This script captures the full desktop and emits the image as base64 to stdout with no user notification, consent, scope restriction, or access control. In a skill explicitly designed for full Windows desktop control, that behavior materially increases the risk of silent collection and exfiltration of sensitive information such as passwords, emails, documents, tokens, or data from unrelated applications.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.