Desktop Automation Hub Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.0

Overview

This desktop automation skill is mostly transparent about its purpose, but it gives broad screen, keyboard, clipboard, and execution power and includes unsafe guidance to run Python as administrator.

Install only if you are comfortable letting an agent control your desktop, read or write the clipboard, take screenshots, and execute generated Python scripts. Keep it as a standard user, do not use it on security tools, login prompts, financial systems, or sensitive apps without explicit review, and prefer a virtual environment with pinned dependencies.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:67

Finding

Unpinned Third-Party Dependencies Create Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 67 and 388-391
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code

bash

pip install pyautogui pillow pygetwindow

The dependency table also instructs users to install the latest available releases:

text

PyAutoGUI | Python library | Required | pip install pyautogui
Pillow | Python library | Required | pip install pillow
PyGetWindow | Python library | Required | pip install pygetwindow
OpenCV | Python library | Optional | pip install opencv-python

Technical Analysis

The Skill instructs the Agent or user to install third-party Python packages without pinning reviewed versions or verifying package hashes. Consequently, the code installed at execution time is not necessarily the code that existed when the Skill was audited.

Although the documented package names are conventional PyPI package names and no suspicious custom index, URL, or known typosquatted package is specified, unrestricted installation of the latest releases creates a mutable supply-chain boundary. A compromised publisher account, package-index compromise, malicious future release, or unexpected upstream behavior could introduce code that executes during package installation or import.

This risk is particularly significant because these packages support screen capture and desktop input automation. Any malicious dependency code would run with the same permissions as the Python process executing the Skill.

Attack Path

1. An upstream dependency, publisher account, or package distribution channel is compromised.
2. A malicious release is published under one of the documented package names.
3. The user or Agent follows the Skill instructions and runs the unpinned pip install command.
4. The package manager resolves the compromised release because no approved version or hash is specified.
5. Malicious code executes duri ...[truncated 905 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace unrestricted package installation commands with a reviewed lock file containing exact versions.
2. Require hashes for every distribution, for example by using pip install --require-hashes -r requirements.txt.
3. Record and review transitive dependencies as well as direct dependencies.
4. Use an explicitly trusted package index and prohibit unreviewed extra indexes.
5. Install dependencies in an isolated virtual environment or restricted container.
6. Run dependency vulnerability and provenance checks before publishing the Skill.
7. Establish a controlled update process in which package upgrades are reviewed and tested before lock-file changes are accepted.
8. Avoid installing optional packages unless the requested operation actually requires them.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:362

Finding

Administrator Execution Guidance Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 362
Vulnerability Type: Unnecessary privilege escalation guidance
Risk Level: High

Vulnerable Instruction

The FAQ recommends the following response when an application blocks simulated keyboard input:

text

Some applications, such as games and security software, block simulated input. Suggested solution: run Python as administrator.

Technical Analysis

The Skill recommends executing Python with administrator privileges to overcome applications that reject simulated input. This expands the execution context beyond the permissions normally required for desktop automation and conflicts with the principle of least privilege.

Running the automation process as administrator does not grant privileges only to a specific input operation. It elevates the generated automation code, imported modules, third-party dependencies, and any unintended commands executed by the process. The recommendation is especially concerning because it explicitly refers to security software, where bypassing input restrictions may cross a deliberate security boundary.

The project contains only documentation and does not automatically invoke an elevation mechanism. Exploitation therefore requires a user to follow the documented recommendation. Nevertheless, the instruction establishes an unsafe operating procedure for a Skill authorized to generate and execute desktop automation scripts.

Attack Path

1. Simulated input fails in a protected, elevated, or security-sensitive application.
2. The user follows the FAQ and launches Python or the Agent with administrator privileges.
3. The Agent generates or executes desktop automation code in the elevated process.
4. All imported dependencies and generated Python logic inherit administrator privileges.
5. A malicious dependency, unsafe generated action, incorrect window selection, or coordinate error performs an unintended pr ...[truncated 931 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the recommendation to run Python or the Agent as administrator.
2. State explicitly that the Skill must operate as a standard user.
3. Prohibit automation of security software, privileged prompts, login interfaces, and other protected desktop boundaries.
4. If an operation legitimately requires elevated access, use a narrowly scoped, separately reviewed helper rather than elevating the entire Agent process.
5. Require explicit user approval immediately before any privileged operation.
6. Apply OS-specific accessibility permissions only to the required application and revoke them when no longer needed.
7. Validate the active window and display a preview before sending input to sensitive applications.
8. Keep the failsafe enabled and add operation allowlists, target-window restrictions, and audit logging.
9. Run all dependencies and generated automation in a sandbox with the minimum necessary filesystem and process permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill exposes screenshot, clipboard read/write, window enumeration, and cross-window automation capabilities that can access or transfer sensitive on-screen or copied data, yet it does not prominently warn users about privacy and data-handling risks. In an agent-executed context, this increases the chance that confidential information is captured, persisted, or moved between applications without informed consent or adequate safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The examples demonstrate form submission, screenshot file creation, and copying data between applications, but they omit warnings that these actions can modify external systems or create local files containing sensitive content. Because the skill is designed for direct desktop control, these examples may normalize high-impact actions without emphasizing verification, consent, or data minimization.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

L394-L396明确说明该技能基于本地 Python 库运行且无需额外 API Key，整体定位为本地桌面自动化。可是在 L455-L459 的错误处理中又把“网络错误、连接超时、ping、防火墙、代理设置”作为该技能运行问题的处理路径，这与前述本地离线定位形成直接意图层面的冲突。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

文档明确将“完全中文化表达，适配中文用户工作流”作为改造特性，但未说明是否支持其他语言或允许用户按偏好选择语言。若组织要求语言/区域中立或需用户自主选择语言，这种单一语言强制默认可能构成自然语言策略问题。

Content

No source excerpt is available for this finding.