ClawHub
Back to skill

Security audit

Peekaboo

Security checks across malware telemetry and agentic risk

Overview

Peekaboo is a clearly disclosed macOS UI automation skill with powerful screen, clipboard, app, and input controls that match its stated purpose.

Install only if you want an agent to control and inspect your Mac UI. Review commands before running them, avoid capturing screens or clipboard contents containing secrets, and do not put real passwords or sensitive account flows into automation unless you explicitly trust the workflow.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly exposes broad screen capture, UI automation, app control, and clipboard read/write capabilities, all of which can access sensitive on-screen data and user content. Documenting these powerful capabilities without any privacy, consent, or sensitive-data handling guidance increases the chance that users or downstream agents will capture secrets, personal data, or confidential business information unintentionally.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The examples demonstrate typing a username and password directly into a UI automation flow, including a literal secret-like value, but provide no warning about secret handling. This normalizes insecure practices such as embedding credentials in scripts, logs, screenshots, or chat transcripts, which can lead to credential disclosure or reuse exposure.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.