Flow Control Hub Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:26 AM UTC
• Version: 1.0.0

Overview

This desktop automation skill is mostly purpose-aligned, but it needs Review because it can type, click, and capture screens while its examples store typed text and credential-filled screenshots without adequate safeguards.

Review before installing. Use this only in a controlled desktop session, avoid real passwords or confidential data in its logging/screenshot examples, pin dependencies in an isolated environment, and require explicit confirmation before any click, typing, paste, save, enter, window switch, or screenshot action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:60

Finding

Unpinned Third-Party Dependencies Installed at Runtime

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60, 96, and 433–436
Vulnerability Type: Supply-chain exposure through unpinned dependencies
Risk Level: Medium

Vulnerable Code

bash

pip install pyautogui pillow

python

except ImportError:
    print("提示：安装 pygetwindow 可启用窗口管理：pip install pygetwindow")

markdown

| pyautogui | Python library | Required | `pip install pyautogui` |
| Pillow | Python library | Required | `pip install pillow` (automatically installed by pyautogui) |
| pygetwindow | Python library | Optional | `pip install pygetwindow` (window management) |
| pyperclip | Python library | Optional | `pip install pyperclip` (Chinese input support) |

Technical Analysis

The Skill instructs users or agents to install third-party Python packages without version constraints, integrity hashes, a lockfile, or an explicitly trusted package index. Consequently, the actual package code installed when the Skill is invoked can differ from the code that existed when the Skill was reviewed.

Python packages can execute code during installation and whenever they are imported. This creates a supply-chain risk if an upstream package, maintainer account, package index, or dependency is compromised. An incorrectly configured package index could also expose the installation to dependency-confusion attacks.

The audit found no evidence that the named packages are intentionally malicious. The vulnerability is the unsafe and non-reproducible dependency acquisition process.

Attack Path

1. An attacker compromises a listed package, one of its transitive dependencies, or a package source used by the environment.
2. The attacker publishes a malicious release that satisfies the unrestricted package name.
3. A user or agent follows the Skill instructions and runs the unpinned pip install command.
4. The malicious package executes code during installation or subsequent impor ...[truncated 580 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed version, such as package==version.
2. Generate a lockfile that also fixes transitive dependency versions.
3. Require package hashes, for example through pip install --require-hashes -r requirements.txt.
4. Configure an explicit trusted index rather than relying on environment-dependent index settings.
5. Install dependencies in an isolated virtual environment with no unnecessary privileges.
6. Scan dependencies for known vulnerabilities and review updates before changing pinned versions.
7. Record the supported package versions directly in the Skill documentation.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:153

Finding

Sensitive Keyboard Input Is Stored in Plaintext Logs and Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 116–121 and 153–156
Vulnerability Type: Plaintext exposure of sensitive input
Risk Level: High

Vulnerable Code

python

logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s - %(levelname)s - %(message)s',
    filename='automation.log'
)
logger = logging.getLogger(__name__)

python

def safe_type(self, text, interval=0.05, desc=""):
    """安全输入文本"""
    try:
        logger.info(f"输入文本：{text[:30]}... - {desc}")
        pyautogui.typewrite(text, interval=interval)
        self.action_log.append({
            'action': 'type', 'text': text, 'desc': desc, 'success': True
        })
    except Exception as e:
        logger.error(f"输入失败：{e}")

Technical Analysis

The safe_type method handles arbitrary keyboard input, which may include passwords, access tokens, personal information, payment data, or confidential form contents. It writes the beginning of every input value to the plaintext automation.log file and retains the complete value in self.action_log.

The method does not distinguish ordinary text from secrets, provide a redaction option, restrict access to the log file, define retention limits, or clear sensitive values after use. Truncating the file log to the beginning of the value is not adequate protection because short passwords and tokens may be recorded in full, while prefixes can still disclose sensitive information.

Attack Path

1. An automation workflow passes a password, token, or other confidential value to safe_type.
2. The method writes the beginning of that value to automation.log.
3. The complete value is appended to the in-memory action_log.
4. A local user, later process, backup service, diagnostic collector, or code with access to the controller reads the retained data.
5. The exposed value is used to access the corresponding account or confidential resourc ...[truncated 513 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not log keyboard input values by default.
2. Replace the log message with non-sensitive metadata, such as the action status and character count.
3. Do not add plaintext input to action_log; record only action type, description, timing, and success status.
4. Add an explicit secret-input API that guarantees redaction and avoids retaining the supplied value.
5. If operational logging is required, enforce restrictive file permissions, rotation, short retention, and encryption at rest.
6. Clear unnecessary references to sensitive values as soon as the operation completes.
7. Add automated tests that verify passwords, tokens, and personal data never appear in logs or action histories.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:368

Finding

Credential-Filled Screen Is Persisted as an Unprotected Screenshot

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 350–369
Vulnerability Type: Plaintext storage of credentials in screenshots
Risk Level: High

Vulnerable Code

python

def capture_step(step_name, region=None):
    """在关键步骤截图并按时间戳归档"""
    timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
    save_dir = Path(f"screenshots/{datetime.now().strftime('%Y%m%d')}")
    save_dir.mkdir(parents=True, exist_ok=True)

    filename = f"{save_dir}/{step_name}_{timestamp}.png"
    pyautogui.screenshot(region=region, filename=filename)
    print(f"截图已保存：{filename}")
    return filename

capture_step("01_login_page")
pyautogui.click(400, 300)
pyautogui.typewrite("testuser", interval=0.05)
pyautogui.press('tab')
pyautogui.typewrite("password123", interval=0.05)
capture_step("02_credentials_filled")

Technical Analysis

The example deliberately takes a screenshot immediately after entering a username and password. The capture function writes the screen image to a persistent PNG file under the screenshots/ directory.

No masking, region exclusion, encryption, restrictive permission handling, retention policy, or secure deletion is applied. If the target application displays the password, offers a password-reveal control, or contains other sensitive information elsewhere on the screen, that information is preserved in the screenshot. Even when a password field is visually masked, the screenshot can still expose usernames, account identifiers, surrounding private information, and authentication context.

The literal password is demonstrative, but the workflow encourages the same unsafe sequence for real credentials.

Attack Path

1. A user adapts the documented workflow to a real login form.
2. The automation enters a username and password.
3. capture_step("02_credentials_filled") captures the populated form and surrounding desktop content.
4. The image is stored as a normal PNG ...[truncated 696 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the screenshot taken after credentials are entered.
2. Capture login pages only before sensitive fields are populated or after authentication has completed and sensitive UI elements are no longer visible.
3. Restrict captures to explicitly approved non-sensitive regions.
4. Mask credential fields and other sensitive screen areas before saving an image.
5. Store necessary screenshots in a restricted temporary directory with least-privilege file permissions.
6. Encrypt retained screenshots and define automatic deletion and retention limits.
7. Warn users that full-screen captures may include unrelated notifications or confidential application content.
8. Add a confirmation or policy check before any screenshot is taken during authentication workflows.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill declares an extremely broad capability/activation scope, including vague phrases that could cause an agent to invoke desktop-control behaviors in loosely related contexts. Because the skill has exec access and can drive mouse, keyboard, and screenshots, overbroad matching materially increases the chance of unintended automation, data entry, or screen capture on sensitive applications.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The scenario captures screenshots before and after entering credentials, including a step immediately after filling username and password. This normalizes storing authentication material on disk and materially increases the risk of credential exposure through image files, backups, or later exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill demonstrates taking screenshots and saving them to disk without clearly warning that screenshots may capture sensitive on-screen data such as emails, documents, tokens, or credentials. In an agent setting, normalizing silent screenshot capture can lead to privacy violations and local persistence of sensitive data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The keyboard automation examples show text entry and hotkeys like save/submit actions without warning that these actions can modify files, submit forms, or trigger irreversible changes. In desktop automation, even simple keystrokes can cause unintended writes or data disclosure if focus is on the wrong window.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples explicitly log typed text and save screenshots/results to disk, which can retain user-provided content and sensitive on-screen data without masking, minimization, or retention controls. This creates a straightforward path to local data leakage through log files and archived images.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The license/description section explicitly states '完全中文化表达，适配中文用户工作流', and the document is written entirely in Chinese with no indication of optional language selection. This can violate language/locale policy when a skill effectively forces one language without explicit user opt-in or a documented region-specific justification.

Content

No source excerpt is available for this finding.