Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Mac desktop automation skill, but it needs Review because it can control live apps, capture or upload screen contents, handle credentials, and start agent/server workflows without enough safety scoping.
Review this before installing if you would not want an agent to see or control your Mac desktop. Use it only with trusted apps and windows, avoid sensitive screens, prefer dry runs for agent/script workflows, do not pass real passwords or API keys on the command line, and stop any daemon or MCP server when finished.
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
# Run an automation task
peekaboo agent "Check Slack mentions" --model gpt-5.1 --verbose
# Dry-run without executing tools
peekaboo agent "Install the nightly build" --dry-run
The description omits a warning that screen capture and UI automation can expose secrets on screen and interact with active applications in ways that modify user data. Because the tool requires Screen Recording and Accessibility permissions, users and downstream agents may underestimate the sensitivity and operational risk of invoking it.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
# Claude Code
mkdir -p ~/.claude/skills/peekaboo-cli
cp -r . ~/.claude/skills/peekaboo-cli/
# OpenClaw
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# Claude Code
mkdir -p ~/.claude/skills/peekaboo-cli
cp -r . ~/.claude/skills/peekaboo-cli/
# OpenClaw
The examples include quitting apps, closing windows, and switching focus without warning that these actions can interrupt active user work or trigger data loss in unsaved documents. In a desktop-control skill, documenting destructive operations without caution materially increases the risk of accidental harmful use.
The skill advertises an 'Autonomous Agent' capability that goes beyond the narrowly described UI automation wrapper and suggests broader delegated behavior. In a tool with screen capture, input injection, window control, and app management, this expands the chance of unsupervised actions against sensitive applications or data.
Referencing a generic 'Run' capability is broader than the stated purpose of macOS UI automation and can normalize arbitrary command execution under the cover of this skill. That kind of scope expansion increases abuse potential because the skill already grants powerful local interaction primitives and may encourage use outside its declared trust boundary.
The documentation describes handing a natural-language task to an agent that can orchestrate actions like seeing, clicking, typing, and menu interaction, but it does not clearly warn users that the command may execute real actions on their behalf. This can lead to unsafe or unexpected automation, especially because users may treat the interface like a passive assistant rather than an active controller of their desktop.
The documentation describes screen and window capture capabilities, including live capture and video output, without any warning about privacy, consent, or the risk of collecting sensitive on-screen data. In a macOS UI automation tool, this increases the likelihood of inadvertent capture of credentials, personal information, confidential documents, or other regulated data during routine use or misuse.
This markdown file documents commands that remove cached snapshot directories, including deleting every snapshot and removing specific snapshots, but it does not include any explicit warning or caution about data loss. Because the skill description covers destructive filesystem actions, a user-facing warning would help set expectations and reduce accidental misuse.
The documentation explicitly states that peekaboo config manages credentials in ~/.peekaboo/ and includes commands to add and validate provider credentials, but it provides no warning about secret handling, file permissions, or avoiding accidental disclosure. In a CLI that manages API keys and OAuth tokens, omitting basic secret-safety guidance can lead users to store, expose, or mishandle sensitive credentials, especially when editing raw config files or sharing debug output.
The examples show raw API keys passed directly on the command line (peekaboo config add openai sk-live-...), which commonly exposes secrets through shell history, process lists, terminal logs, and recorded sessions. Because this tool is specifically for desktop automation and screen capture, the surrounding skill context makes accidental credential exposure more likely during demos, automation, screenshots, or captured terminal sessions.
The documentation explicitly demonstrates entering credentials into a password prompt using a CLI argument, but provides no warning about handling secrets safely. In this skill's context, macOS UI automation can be used against real authentication dialogs, and placing passwords directly in command examples encourages exposure through shell history, process arguments, logs, or transcripts.
The documentation claims peekaboo image produces raw image files, but also exposes an --analyze option that sends the saved screenshot to a configured AI provider. In a macOS UI automation tool, screenshots can easily contain sensitive material such as emails, credentials, tokens, customer data, or proprietary UI state, so presenting remote analysis as a normal option without clear warning expands data exfiltration risk beyond local capture.
The --analyze "prompt" option describes sending captured images to an AI provider but provides no privacy, consent, or data-sharing warning. Because this tool automates screenshots of windows, screens, and frontmost apps, the missing warning can mislead users into transmitting highly sensitive desktop content off-device without understanding the exposure.
The example explicitly encourages users to capture every display and summarize the screenshots with AI, normalizing broad collection and external transmission of desktop contents. In the context of a macOS desktop automation skill, multi-display captures can include chats, secrets, internal documents, and security prompts, so omission of any warning materially increases accidental data leakage risk.
The documentation describes a command that temporarily replaces the system clipboard and later restores it, but it does not explicitly warn users that sensitive clipboard contents may be exposed, lost, or interfere with other applications during the replacement window. In a macOS automation tool, clipboard manipulation is security-relevant because users may have passwords, tokens, or confidential data copied at the time the command runs.
The documentation explains how to capture the current macOS UI, extract accessibility metadata, and save annotated screenshots, but it does not warn users that these outputs may contain sensitive information such as credentials, personal messages, documents, or other on-screen secrets. In a desktop automation skill, this omission is meaningful because users may run captures broadly (--mode screen, menu bar capture, saved files) and then expose or persist sensitive data unintentionally.
The documentation describes synthetic typing capabilities, including sending Return, Tab, Delete, and clearing fields, but does not warn that these actions can trigger command execution, submit forms, or modify data in the targeted application. In a macOS UI automation tool, this omission increases the risk that users invoke the command in sensitive contexts such as Terminal, password fields, admin dialogs, or production applications without understanding the consequences.
The documentation describes clipboard write, clear, save, and restore operations without explicitly warning that these actions can overwrite or erase the user's current clipboard contents. In a UI automation tool, this can lead to unintended data loss, disruption of user workflows, or accidental handling of sensitive clipboard contents if operators invoke examples without realizing the side effects.
This markdown file documents the close subcommand, which can immediately dismiss a window and potentially cause data loss if the target app has unsaved changes, but it provides no warning or caution to the user. Under the markdown variant of SQP-2, skills should disclose behaviors that may affect user data or system integrity.
No suspicious patterns detected.