Security audit

Windows Control

Security checks for vulnerabilities and agentic risk

Overview

This skill openly provides broad Windows desktop control, but its unrestricted clicks, keystrokes, screen reading, and dialog actions need careful review before use.

Install only if you intentionally want an agent to control and read your Windows desktop. Use it in a controlled session, prefer listing/reading windows before acting, avoid sensitive apps or visible secrets, and require explicit human confirmation before clicks, hotkeys, closing windows, saving, accepting, deleting, or dismissing dialogs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (32)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The description is substantially broader than the code. The script does operate on Windows UI elements and can interact with applications, but only by enumerating accessible controls and clicking matching elements. It also supports listing clickable controls. It does not implement keyboard control, screenshot capture, general mouse movement/control, or unrestricted full desktop interaction. This is a material description-behavior mismatch because the declared purpose promises broad desktop control capabilities that are absent from the supplied code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The description claims a broad Windows desktop automation capability set: mouse, keyboard, screenshots, and general interaction with any Windows application. The actual code only enumerates desktop windows via pywinauto, matches a window title, and closes the window. While closing a window is related to Windows UI interaction, the implemented functionality is materially narrower than the declared purpose and does not implement the advertised capabilities. This is a description-behavior mismatch due to overbroad declared functionality versus a single specific action.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises broad Windows desktop automation capabilities: mouse, keyboard, screenshots, and interaction with any Windows application. The supplied code chunk only enumerates desktop windows and UI descendants via pywinauto UIA, searches for matching visible text, and outputs the matching control's coordinates/bounds. That is a much narrower capability focused on locating text in UI elements. There is no implementation of mouse input, keyboard input, screenshot capture, or general interaction. Therefore the description does not accurately represent this code chunk's actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description is much broader than the supplied code. This script performs a narrow window-management task: finding a matching window and focusing it. It does not provide full Windows desktop control, does not simulate mouse or keyboard input, and does not capture screenshots. While focusing a window is related to desktop interaction, the actual behavior is only a small subset of the declared functionality, so the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description advertises broad Windows desktop control with human-like interaction capabilities, including mouse, keyboard, and screenshots. The supplied code only queries the currently focused window and prints its title. This is a much narrower function and does not implement the primary capabilities described. Therefore the description does not accurately represent the actual behavior of this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description significantly overstates the code’s functionality. The code is specialized for detecting and interacting with Windows dialogs and popups, such as save/open/message boxes. It can inspect controls, click buttons, type into dialog fields, dismiss dialogs, and wait for dialogs to appear. However, it does not provide full Windows desktop control, does not capture screenshots, and does not expose broad mouse/keyboard automation for arbitrary applications. This is a materially different and narrower purpose than declared.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This is a description-behavior mismatch because the declared purpose promises broad interactive Windows desktop control, while the supplied code chunk is limited to passive discovery of open windows and their states. Although window enumeration could be a supporting component of a larger desktop-control skill, this specific code does not implement the core declared capabilities and has a materially narrower primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description claims a comprehensive Windows desktop control capability with mouse, keyboard, screenshots, and general interaction across applications. The supplied code only enumerates UIA desktop windows, matches one by title substring, and maximizes it. That is a much narrower behavior and does not implement the advertised input control or screenshot capabilities. This is a material description-behavior mismatch because the declared purpose significantly overstates what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description claims a broad Windows desktop control capability with mouse, keyboard, screenshots, and human-like interaction across applications. The supplied code only reads four coordinate arguments, captures a screenshot of that region, and optionally runs OCR to extract text. It does not send mouse or keyboard input, manipulate windows, or provide general interactive control. While screenshot capture is loosely consistent with part of the description, the primary purpose is materially narrower and different: screen-region OCR/text extraction.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description advertises a broad remote-control skill for Windows desktop interaction: controlling mouse and keyboard, taking screenshots, and interacting with any application. The supplied code only inspects a matching window's UI tree and reports interactive elements and coordinates. This is a materially narrower and different primary purpose: passive UI element discovery rather than full desktop control. While the extracted coordinates could support later clicking, this chunk itself does not click, type, capture the screen, or otherwise control applications. Therefore the description does not accurately represent the actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This is a strong description-behavior mismatch. The declared purpose claims broad interactive desktop automation across any Windows application, including mouse, keyboard, and screenshots. The supplied code does none of those things. It specifically searches for browser windows and reads UI element content from them using pywinauto. Its behavior is limited to inspection/extraction of webpage-related content and does not perform input actions, capture screenshots, or control arbitrary desktop apps. The actual primary purpose is browser content reading, not full Windows desktop control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad Windows desktop automation skill capable of interacting with applications like a human via mouse, keyboard, and screenshots. The supplied code does not implement any of those capabilities. Instead, it only searches for a window by title and reads text from its descendants. This is a materially different primary purpose and a much narrower, read-only capability set than advertised.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description advertises a broad remote-control capability over the Windows desktop, including mouse and keyboard interaction with arbitrary applications. The supplied code chunk implements only a screenshot capture function and returns the image as base64. Screenshot functionality is consistent with part of the description, but the primary declared scope ('full Windows desktop control') is materially broader than the actual behavior shown here. Therefore the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description claims broad Windows desktop control with interactive capabilities such as mouse, keyboard, screenshots, and human-like interaction with any application. The supplied code does not perform any of those actions. Instead, it only enumerates desktop windows, filters by window title, inspects descendant controls for matching text, and waits until the text appears or times out. This is a materially narrower and different primary purpose: passive monitoring for UI text, not full desktop control.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description advertises a broad Windows desktop automation capability set: mouse, keyboard, screenshots, and interaction with any application. The actual code chunk performs a much narrower task: it enumerates windows and waits until one with a matching title exists. This is related to Windows UI automation, but it does not implement the primary capabilities claimed in the description. Because the actual behavior is materially narrower and different from the declared purpose, this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill exposes destructive or confirmation-driving actions such as closing windows, dismissing dialogs, clicking buttons like 'Yes' or 'Save,' and sending key combinations, but provides no warning about data loss, unintended submissions, or unsafe confirmations. In a full desktop automation context, these capabilities are more dangerous because they can irreversibly discard unsaved work, approve security prompts, or trigger transactions if invoked on the wrong window or dialog.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documents broad abilities to read window text, UI elements, webpages, dialogs, and screenshots without any warning that these features can expose secrets visible on screen or in application memory-backed UI text, such as tokens, passwords shown in dialogs, emails, or sensitive documents. In the context of a desktop-control skill, omission of these warnings increases the risk of over-collection and inadvertent data exfiltration because the documented workflow encourages pervasive inspection of active windows and browser content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest explicitly advertises full Windows desktop control, including mouse, keyboard, and screenshots, but provides no warning, safety boundary, or consent language about high-impact system interaction. In the context of an agent skill, this increases the risk of unintended sensitive actions such as interacting with arbitrary applications, capturing confidential information, or driving harmful workflows without adequate user awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This script performs an immediate GUI click at arbitrary screen coordinates with no confirmation, target validation, bounds checking, or safety interlock. In the context of a skill explicitly designed for full Windows desktop control, that enables unintended or unauthorized interaction with any application, including approving prompts, altering settings, launching programs, or clicking through security dialogs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This script performs an immediate UI click on a matched control with no confirmation, safety interlock, or allowlist, and it can search across all visible windows by partial text match. In a skill explicitly designed for full Windows desktop control, that behavior can activate destructive or security-sensitive actions such as deleting data, approving prompts, dismissing warnings, or executing privileged workflows in the wrong application.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script automatically clicks the first UI element whose text loosely matches user-supplied input, with no confirmation, dry-run mode, or validation that the target is the intended control. In a full desktop-control skill, this can trigger unintended or security-sensitive actions such as approving prompts, submitting forms, deleting data, or interacting with privileged system dialogs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script closes the first window whose title merely contains the user-supplied substring, and does so immediately without validation, confirmation, or narrowing to a specific process or exact title. In a skill designed for full desktop control, this increases the chance of unintended termination of unrelated applications, potentially causing data loss or interruption of security-sensitive workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The click operation will activate any enabled button whose label contains the requested substring, with no validation of side effects or exact match requirement. In the context of unrestricted desktop automation, this can trigger harmful actions such as confirming file replacement, sending data, granting permissions, deleting content, or accepting security prompts, especially because substring matching may hit an unintended button.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The dismiss action automatically tries common buttons like OK, Yes, No, Cancel, and Accept, then falls back to sending Escape, without inspecting the dialog semantics or requiring confirmation. In a full Windows desktop control skill, this can unintentionally approve destructive, security-relevant, or privacy-impacting prompts such as overwrite confirmations, installer/UAC-like dialogs, or data-loss warnings.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This script captures an arbitrary screen region and runs OCR on it, which can extract sensitive information such as passwords, tokens, messages, or financial data if the selected coordinates include them. In a skill explicitly designed for full Windows desktop control, the lack of any consent prompt, sensitivity checks, or warning materially increases the risk of privacy-invasive or unauthorized data collection.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.