Security audit

windows-agent

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed local Windows desktop-control skill, but it deserves Review because it can see, read, type, click, and manage processes across the desktop with limited built-in scoping.

Install only if you intentionally want an agent to control your Windows desktop. Use it on your own machine, avoid sensitive windows unless explicitly needed, review actions before clicks/typing/process kills, and clean up saved screenshots or clipboard changes after use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The changelog documents an active recording feature (`record.ps1`, start/status/stop, mp4 output) even though the skill metadata describes desktop control, screenshots, UI automation, and process management without disclosing screen recording. This capability mismatch can mislead reviewers and downstream users about the true surveillance scope of the skill, increasing the risk of unintended capture of sensitive on-screen data.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The file states that the screen-recording module was 'cut/removed' early in the changelog, but later sections describe `record.ps1` as present, tested, and required. Contradictory security-relevant documentation obscures whether recording functionality exists, making audit, consent, and deployment decisions unreliable for a high-privilege Windows control skill.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The script implements clipboard read, write, and clear functionality, but the provided skill metadata only describes screen, window, input, UI automation, and process control capabilities. Undisclosed clipboard access expands the skill's effective privilege surface and can surprise users by exposing or modifying sensitive data such as passwords, tokens, copied documents, or file paths.

Vague Triggers

High

Confidence: 94% confidence
Finding: The skill advertises very broad activation phrases such as "看屏幕", "输入文字", "打开应用", and "控制程序", which overlap with common user requests and can cause the agent to invoke a highly privileged desktop-control skill too readily. Because this skill can observe the screen, manipulate windows, send input, and manage processes, accidental or overly eager activation materially increases the chance of unauthorized actions and privacy-invasive behavior.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill prominently documents screen observation and screenshot capabilities but does not provide a clear privacy warning that captures may include passwords, personal messages, tokens, financial data, or other sensitive on-screen information. In a remote desktop-control context, this omission increases the risk that users or downstream agents collect sensitive visual data without informed consent or minimization.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill exposes clipboard read, write, and clear operations without a clear warning that clipboard contents often contain sensitive data such as passwords, MFA codes, API keys, wallet addresses, or personal information. Although there is a brief operational note about backing up clipboard contents, it does not function as a privacy/security warning or require consent before accessing or modifying potentially sensitive data.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script executes arbitrary queued mouse and keyboard actions immediately, without any confirmation, safety prompt, target-window validation, or allowlist. In the context of a Windows desktop control skill, this is dangerous because a malformed or adversarial sequence can click security prompts, type into sensitive applications, close windows, or trigger destructive UI actions on the host machine.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The get action directly reads clipboard contents and returns them to the caller without any warning, consent gate, or sensitivity check. Clipboard data commonly contains secrets or private content, so exposing it through an automation skill can leak credentials, personal data, or confidential business information beyond the user's expectation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The set and clear actions overwrite or erase the user's clipboard contents without an explicit warning or backup. This can destroy user data in session, interfere with workflows, and enable covert tampering by replacing copied content such as wallet addresses, commands, or account numbers before a paste operation.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script enumerates UI elements from either a user-specified window or the currently focused window and prints discovered text content with no filtering, consent check, or sensitivity guard. This can expose passwords, messages, documents, tokens, or other private on-screen data to the calling agent or logs, especially when the default behavior targets whatever window currently has focus.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This script directly captures full-screen, window, or region screenshots and writes them to disk without any built-in confirmation, warning, redaction, or sensitivity checks. In the context of a remote desktop-control skill, this can expose passwords, tokens, private messages, regulated data, or other on-screen secrets, and the saved PNG files create persistent sensitive artifacts that may be accessed later.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The default output directory is partially derived from the OPENCLAW_STATE_DIR environment variable, allowing screenshot files containing sensitive on-screen data to be written to an environment-controlled location without transparent disclosure. In an agent setting, this increases the risk of unintended persistence, exposure to other components, or storage in less trusted paths than the user expects.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: This script can enumerate controls and then perform live clicks, text entry, invocation, and scrolling against arbitrary desktop windows, including foreground targets when no explicit target is supplied. In the context of a general-purpose Windows control skill, that enables unintended or unauthorized actions such as confirming dialogs, changing settings, sending messages, or interacting with security-sensitive prompts with no built-in confirmation, allowlist, or safety gating.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The helper functions spawn a secondary PowerShell process using '-ExecutionPolicy Bypass' to run input.ps1, which weakens host execution-policy safeguards and makes downstream script execution less controllable. In a desktop-control skill that can already generate input, this increases abuse potential because any compromise or replacement of the helper script executes under intentionally reduced policy restrictions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: When the open workflow fails, the script silently captures the user's desktop and writes it to disk, which can collect sensitive information such as messages, documents, passwords, or other on-screen data without an explicit warning or consent checkpoint. In the context of a desktop-control skill, this is more dangerous because screenshots are a powerful surveillance primitive and the image is persisted to a file path that may be accessible to other components.

Ssd 3

Medium

Confidence: 97% confidence
Finding: This skill is intentionally built to extract and output essentially all readable text from an arbitrary desktop window, which is a direct data-exfiltration capability. In the context of a remote-control Windows agent, this is more dangerous because it can be invoked across many applications and the empty-target behavior makes accidental or covert collection from the active window easy.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.