ClawHub
Back to skill

Security audit

桌面自动化中枢(专业版)

Security checks for vulnerabilities and agentic risk

Overview

This desktop automation skill is broadly useful, but it gives agents high-impact control over files, screens, terminals, and production commands without strong enforced boundaries.

Install only if you are comfortable giving an agent broad desktop-control authority. Use approval mode by default, avoid production terminals and credential entry, restrict what files and applications it can touch, and do not allow external callbacks or API integrations with sensitive screen or clipboard content unless explicitly needed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The skill claims command execution is limited to a whitelist, but the documented behavior shows an agent controlling terminal windows and typing arbitrary commands, including privileged ones elsewhere in the file. That mismatch is dangerous because users and higher-level policy may rely on the stated restriction while the actual capability enables unrestricted shell interaction via GUI automation.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The activation language is very broad ('improve efficiency,' 'workflow optimization') and can cause the skill to trigger for generic productivity requests unrelated to safe desktop automation. Overbroad invocation increases the chance that an agent enters a high-risk capability path—file changes, UI control, clipboard access, or command execution—without a clearly scoped user intent.

Vague Triggers

Medium
Confidence
89% confidence
Finding
Claiming coverage of 'all desktop automation scenarios' makes the skill boundary undefined and encourages use in sensitive contexts far beyond ordinary GUI automation. In a skill with exec, write, screen reading, and approval-bypass-by-default examples, unclear boundaries materially increase misuse risk.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The skill advertises file reading and writing capabilities but does not prominently warn that local files may be modified or overwritten. In a desktop automation context, silent file mutation can lead to data loss, unintended persistence, or tampering with user documents and configuration files.

Missing User Warnings

Medium
Confidence
80% confidence
Finding
The documentation advertises external API/service integration without a prominent disclosure that data may be transmitted off-device. In this skill, screenshots, clipboard data, filenames, and application content could be exposed through networked workflows if users are not clearly informed.

Missing User Warnings

High
Confidence
96% confidence
Finding
The skill explicitly advertises system command execution while also exposing desktop control and terminal automation patterns, but lacks a prominent warning about system-impacting actions. This combination can enable destructive commands, persistence changes, or environment modification with little user awareness.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
)
def prod_maintenance():
    dc.activate_window("SSH Terminal")
    dc.type_text("sudo systemctl restart nginx")
    dc.press('enter')
    dc.pause(5)
    dc.type_text("sudo systemctl status nginx")
Confidence
97% confidence
Finding
The skill includes an example that types 'sudo systemctl restart nginx' into an SSH terminal, demonstrating privileged command execution in a production-like environment. Even though shown as an example, this normalizes and operationalizes root-level actions through GUI automation, which is brittle, hard to audit, and dangerous if triggered on the wrong host or session.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
dc.type_text("sudo systemctl restart nginx")
    dc.press('enter')
    dc.pause(5)
    dc.type_text("sudo systemctl status nginx")
    dc.press('enter')
    dc.screenshot(filename='nginx_status.png')
prod_maintenance()
Confidence
97% confidence
Finding
The second example command, 'sudo systemctl status nginx,' further confirms the skill is intended to drive privileged shell sessions rather than merely document abstract concepts. In context, this makes the skill more dangerous because it combines broad activation language, command execution, and terminal automation with production-operations scenarios.

Static analysis

No suspicious patterns detected.