ClawHub
Back to skill

Security audit

桌面自动驾驶

Security checks for vulnerabilities and agentic risk

Overview

This desktop automation skill is mostly purpose-aligned, but it asks for powerful GUI control while documenting raw input logging, persistent screenshots, broad activation, and possible administrator use.

Review carefully before installing. Use it only in a constrained desktop environment, avoid administrator execution, do not automate banking, authentication, payment, or security-token interfaces, and assume screenshots and logs may capture private data unless logging is disabled or redacted. Pin and verify dependencies before use.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:278
Finding

Persistent Plaintext Logging of Typed Sensitive Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:278-283
Vulnerability Type: Sensitive data exposure through persistent plaintext logs
Risk Level: High

Vulnerable snippet:

text
All operations are automatically recorded under:
$HOME/.skill-platform/autopilot/logs/

2026-07-18T09:00:00Z | click_image | submit.png | SUCCESS | (520, 340)
2026-07-18T09:00:02Z | type_text | john@example.com | SUCCESS
2026-07-18T09:00:05Z | wait_for_text | Login successful | TIMEOUT | The text did not appear within 10 seconds

The prose and localized status text above are rendered in English while preserving the behavior documented by the source.

Technical Analysis

The skill states that every operation is recorded persistently and demonstrates that the complete argument supplied to type_text is included in the log. GUI automation commonly types passwords, API tokens, personal information, payment details, recovery codes, and other secrets.

Logging raw input values creates a secondary plaintext repository of sensitive information. The document does not define value redaction, field classification, restrictive file permissions, encryption, retention limits, or secure deletion. Its later generic recommendation to prevent secrets from appearing in output does not correct the explicitly demonstrated logging behavior.

Because the project contains no implementation, the precise permissions and retention behavior cannot be validated. Nevertheless, following the documented logging design would directly expose typed values.

Attack Path

  1. A user invokes the skill to automate a login, account setup, payment form, or another sensitive workflow.
  2. The workflow calls type_text with a username, password, token, or personal record.
  3. The documented operation logger writes the complete input value under $HOME/.skill-platform/autopilot/logs/.
  4. Another local user, process, backup agent, diagnostic collector, suppor ...[truncated 629 chars]
Remediation
View remediation

Remediation Suggestions

  • Never record the raw argument supplied to keyboard-input or clipboard-paste operations.
  • Log only the action type, timestamp, target application or field identifier, status, and a value such as [REDACTED].
  • Treat password, token, payment, authentication, and identity fields as sensitive by default.
  • Make diagnostic value logging an explicit, short-lived opt-in mode with prominent warnings.
  • Create log files with owner-only permissions and reject insecure pre-existing log directories or symbolic links.
  • Define strict retention and secure-deletion policies.
  • Avoid collecting screenshots around password, payment, or token fields unless explicitly authorized.
  • Add automated tests proving that passwords, API keys, email addresses, tokens, and clipboard contents never appear in logs.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:70
Finding

Unpinned Runtime Installation of Desktop-Control Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:70
Vulnerability Type: Unpinned and non-reproducible third-party dependency installation
Risk Level: Medium

Vulnerable snippet:

bash
pip install pyautogui pillow opencv-python pygetwindow pytesseract

The same unsafe installation pattern is repeated at SKILL.md:376-382 and SKILL.md:442.

Technical Analysis

The installation command does not pin reviewed package versions, verify package hashes, use a lock file, or constrain the package index. Each installation can therefore resolve to different package artifacts over time.

Python package installation may execute package-controlled build or installation logic. A compromised upstream release, package-index account, mirror, dependency, or name-resolution path could consequently introduce arbitrary code into the Agent environment.

This risk is amplified by the dependencies' intended capabilities: screen capture, OCR, window inspection, and keyboard and mouse control. The project also references from desktop_autopilot import Autopilot, but the documented installation command does not install that module and the repository does not include it. A user attempting to resolve the missing module independently could install an unrelated or malicious similarly named package.

No malicious dependency is proven to be present in the reviewed artifact. The confirmed issue is the unsafe, mutable dependency acquisition process.

Attack Path

  1. The Agent or user follows the documented pip install command.
  2. Pip resolves the latest packages and transitive dependencies from the configured package source.
  3. A compromised release, package source, or dependency supplies malicious installation or runtime code.
  4. The code executes with the permissions of the Agent or user performing installation.
  5. It can abuse the desktop-automation context to inspect files, capture screen content, monitor input, manipula ...[truncated 684 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin every direct and transitive dependency to a reviewed version.
  • Publish a lock file and require hash verification, such as pip's --require-hashes.
  • Use an authenticated, controlled package repository or an allowlisted internal mirror.
  • Install dependencies in a dedicated virtual environment or sandbox under an unprivileged account.
  • Generate and review a software bill of materials.
  • Scan dependency artifacts and monitor upstream advisories before updating versions.
  • Explicitly package the referenced desktop_autopilot implementation or identify its authenticated source, exact version, and artifact hash.
  • Do not instruct users to search for or install a similarly named package to satisfy the missing import.
  • Separate build-time installation from execution and prohibit automatic package installation during skill invocation.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:347
Finding

Privilege Elevation Recommended to Bypass Protected Input Controls

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:347
Vulnerability Type: Violation of least privilege for security-sensitive GUI automation
Risk Level: High

Vulnerable source guidance, translated into English:

text
Some games and security applications, such as banking USB-token software,
block SendInput. Try running with administrator privileges, or use the
application's own API or CLI.

Related guidance at SKILL.md:387 states:

text
Some application automation may require administrator privileges.

Technical Analysis

The documentation recommends administrator execution when applications reject simulated input. Input rejection in games, banking software, credential interfaces, and other protected applications can represent an intentional trust boundary. Elevating a general-purpose screen and input automation process to bypass that boundary unnecessarily expands its authority.

Administrator execution also elevates all loaded Python dependencies and workflow logic, not only the individual input operation. The documented approval prompt and failsafe do not provide an operating-system privilege boundary and cannot contain malicious or compromised code running inside the same elevated process.

The project contains no implementation that enforces least privilege, application allowlists, protected-interface denial, process isolation, or privilege dropping.

Attack Path

  1. The automation attempts to send simulated input to an application that rejects it.
  2. The user follows the documented recommendation and relaunches the Agent or script with administrator privileges.
  3. The automation implementation, workflow logic, and all Python dependencies inherit elevated permissions.
  4. A malicious workflow, compromised dependency, incorrect visual match, or unexpected UI state causes unintended privileged input or local actions.
  5. The elevated process interacts with protected application ...[truncated 705 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the recommendation to elevate privileges to bypass blocked simulated input.
  • Require the Agent and all automation dependencies to run as an ordinary user by default.
  • Refuse automation of protected authentication, banking, security-token, anti-cheat, and consent interfaces.
  • Prefer documented application APIs, accessibility interfaces, or vendor-supported automation mechanisms with explicit authorization.
  • If a narrowly scoped privileged helper is genuinely required, isolate it from the Agent and expose only a minimal authenticated operation set.
  • Apply application and action allowlists to any privileged helper.
  • Require explicit approval immediately before each privileged operation and display the exact application, action, and affected resource.
  • Drop elevated privileges before loading workflows, image templates, plugins, or other externally influenced content.
  • Add tests confirming that ordinary GUI failures never trigger automatic privilege elevation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation language is extremely broad, including generic phrases around AI models, dialogue, agent orchestration, and LLM applications. In an agent platform, this can cause the skill to trigger for unrelated tasks and grant GUI automation capabilities in contexts where the user did not intend desktop control, increasing the chance of unsafe clicks, data entry, or interaction with sensitive apps.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The '职责边界' table says file-system operations belong to the system controller, not this skill. However, elsewhere the document describes this skill saving screenshots to files, writing logs under $HOME, storing snapshots, and persisting workflows to JSON files (for example L199-L201, L245-L246, L277-L279), which directly contradicts that boundary statement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The examples include potentially destructive or irreversible GUI actions such as clicking delete-like icons, submitting forms, and copying/pasting data without consistently requiring approval or warning the operator. In a desktop automation context, mistaken element detection or window focus errors can cause immediate real-world impact, including data loss, unintended submissions, or leakage across applications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documents persistent screenshots, snapshots, and operation logs, but does not give a clear upfront warning that these artifacts may capture sensitive on-screen data, credentials, personal information, or proprietary material. Because this is a desktop automation skill operating on live user interfaces, the context makes the privacy risk more serious than in ordinary logging features.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented operation logs include raw user-entered content such as email addresses and potentially other form data. On a desktop automation skill, those logs can accumulate sensitive personal, business, or secret material and become a secondary data store that is easier to access, retain, or exfiltrate than the original application, significantly increasing confidentiality risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The capability scope mixes broad keywords like 'Use', 'when', '模型调用', '智能对话', and 'LLM' with desktop automation terms, making invocation matching overly permissive. In practice, this can route many unrelated requests into a high-risk skill that has exec, read, and write tools plus GUI control, expanding the attack surface and increasing the probability of unintended actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Earlier documentation states '本技能为本地桌面操作，无需外部 API Key' and that OCR also requires no key (L384-L387). Later, the FAQ answer says '是的，部分功能需要配置对应平台的API Key', which directly conflicts with the stated local-only, no-key design and changes the implied operating model.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The display name, summary, and description are presented in Chinese only, with no indication that the skill can adapt to the user's preferred language or locale. This can violate language-choice expectations if the organization requires skills not to force a specific language without user opt-in.

Content

No source excerpt is available for this finding.