Security audit

Watchitai

Security checks across malware telemetry and agentic risk

Overview

This looks like a real screen-sharing and remote-control skill, but it needs Review because it downloads and runs an unverified remote binary with screen/input privileges and leaves some local control and credential details under-scoped.

Install only if you trust WatchItAI as a binary publisher and are comfortable granting screen viewing and optional remote keyboard/mouse control. Prefer view-only sessions, stop the bridge when finished, avoid exposing secrets on screen, and treat config.json as potentially sensitive if you authorize an account.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Context-Inappropriate Capability

Medium

Confidence: 79% confidence
Finding: The skill goes beyond transient screen sharing by supporting account authorization and writing obtained credentials into `config.json`. Credential storage and account linking expand the trust boundary: compromise of the skill, local files, or downloaded binaries could expose reusable account tokens and enable persistent access or abuse of the associated service.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The security section claims all sensitive control endpoints require `bridgeToken`, but the documented WebSocket bridge exposes mouse, keyboard, wheel, and screenshot-related capabilities without any stated authentication or handshake requirements. If the local bridge accepts unauthenticated WebSocket connections from local processes or browser contexts, an attacker on the same machine could hijack input, capture the screen, or create sessions without user approval.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: If the expected binary is missing, the launcher silently retrieves and installs an executable from the internet at runtime. Even though the URL uses HTTPS, there is no signature or hash verification, so a compromised server, CDN, build pipeline, or local TLS interception point could cause execution of a trojaned binary with the user's privileges.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The launcher can retrieve an executable from the network at runtime and then immediately mark it executable and run it. That breaks the 'self-contained' trust model and creates a supply-chain execution path where a compromised server, DNS/TLS interception, or unexpected binary swap could result in arbitrary code execution on the host.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The script strips macOS quarantine metadata and ad-hoc signs the binary before execution, weakening platform protections designed to warn users about untrusted code. Combined with the download/decompression flow, this increases the chance that an unreviewed or replaced binary executes without normal OS friction.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README prominently advertises optional remote mouse and keyboard control but does not provide a clear, immediate warning that granting such control can allow a remote party to operate the host machine, trigger commands, access applications, and potentially exfiltrate sensitive data. In the context of an AI-agent screen sharing skill, this omission is more dangerous because users may enable control for automation or assistance without fully appreciating that they are exposing interactive access to their workstation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The screen-sharing instructions tell users how to start sharing but omit a conspicuous privacy warning that on-screen secrets such as passwords, tokens, emails, source code, and internal documents may be exposed to viewers. This is especially risky here because the skill is designed for real-time monitoring of AI agents, which often work in developer environments containing credentials and proprietary material.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The script creates a config.json next to the skill and later relies on it for account binding data, including an access key, without notifying the user or enforcing restrictive file permissions. Storing credentials in a predictable local file can expose them to other local users, backup/sync systems, malware, or accidental disclosure during support/log sharing.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The script creates a local config file intended to hold service configuration and potentially an access key, but it provides no explicit notice to the user about credential persistence. While permissions are restricted to mode 600, silent local storage of tokens can create privacy and account-risk issues on shared systems or in environments where users assume ephemeral auth.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.