屏幕监控工具-免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:36 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed screen-capture tool, but it should be reviewed because its trigger scope, network callback field, dependency installation, and Windows admin advice are broader than necessary for sensitive screenshot access.

Install only if you are comfortable giving the agent screen-capture authority. Use it only for explicit screenshot requests, avoid timed monitoring unless you set the duration and output folder yourself, do not send callback URLs unless you understand what will be transmitted, install dependencies in a virtual environment from trusted sources, and avoid running the agent or installer as administrator.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:176

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 176
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code

bash

# Python dependencies
pip install Pillow pyautogui pytesseract

The same unpinned installation instructions are repeated for individual dependencies at SKILL.md:257-259.

Technical Analysis

The skill directs users or agents to install three packages without exact version constraints, package hashes, a lockfile, or an isolated environment. Dependency resolution therefore depends on mutable package-index state at installation time.

Python package installation can execute package-controlled build or installation logic. If a dependency account or release is compromised, an unsafe future version is published, or package resolution is redirected to an untrusted index, following these instructions could run attacker-controlled code. The screenshot-related permissions requested by this skill make such a compromise particularly sensitive because the resulting process may have access to screen contents.

No evidence shows that the currently named packages are malicious. The vulnerability is the unsafe and non-reproducible dependency acquisition process.

Attack Path

1. An attacker compromises a referenced package, its publisher account, or the package source used by the local Python configuration.
2. The attacker publishes a malicious release or otherwise influences dependency resolution.
3. A user or agent follows the documented pip install command.
4. pip resolves the attacker-controlled package version and executes its installation or build behavior.
5. The installed package executes when the screen-capture workflow imports or invokes it.
6. The payload operates with the privileges of the Python process and may access locally available screen data, files, environment variables, and network resources.

Impact Assessment

Successfu ...[truncated 340 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to a reviewed exact version in a requirements file.
2. Generate and verify cryptographic hashes, for example by using a hash-locked requirements file and pip install --require-hashes.
3. Publish a lockfile or reproducible dependency manifest covering transitive dependencies.
4. Install dependencies inside a dedicated virtual environment rather than the system Python environment.
5. Explicitly use a trusted package index and prevent unintended fallback to untrusted indexes.
6. Add automated dependency vulnerability and provenance scanning.
7. Document that dependency installation must not be performed from an administrator or root shell.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:234

Finding

Blanket Administrator Execution Guidance Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 234
Vulnerability Type: Unnecessary privilege elevation guidance
Risk Level: Medium

Vulnerable Source Excerpt

text

Windows: Run with administrator privileges.

This is an English rendering of the complete Windows-specific instruction at the cited source line.

Technical Analysis

The troubleshooting guidance recommends administrator execution on Windows without identifying a privileged operation that requires it. Ordinary screenshot capture should normally rely on narrowly scoped operating-system screen-capture permissions and user-session access rather than unrestricted administrator privileges.

Running the Agent, Python interpreter, or dependency installation process as an administrator expands the authority of every imported dependency and executed command. This compounds the unpinned dependency risk identified elsewhere in the document. The project contains no implementation demonstrating that administrator rights are technically necessary.

Attack Path

1. A screenshot attempt fails because of a display-session, permission, or configuration issue.
2. The user follows the documented troubleshooting advice and starts the terminal, Agent, or Python process as an administrator.
3. The user installs dependencies or invokes the documented screenshot workflow from that elevated process.
4. A compromised dependency, unsafe future implementation, or unintended command consequently executes with administrator rights.
5. The executing code can modify system-level resources that would have been unavailable under a standard user account.

Impact Assessment

Exploitation could elevate the consequences of malicious or vulnerable code from user-level access to administrator-level access. Depending on Windows security configuration, this may permit modification of protected files and configuration, installation of software or services, access ...[truncated 271 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the blanket instruction to run with administrator privileges.
2. Document the minimum Windows permissions actually required for screen capture.
3. Provide non-elevated troubleshooting steps for session access, display configuration, and privacy controls.
4. If a specific operation genuinely requires elevation, isolate it into a narrowly scoped, auditable step and explain why it is necessary.
5. Explicitly warn users not to install Python dependencies or run the full Agent under an administrator account.
6. Test the intended workflow under a standard user account and make least-privilege execution the supported default.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger conditions are overly broad and unrelated to a narrow screenshot utility, stating the skill should be used for project management, task planning, progress tracking, and team collaboration. In an agent environment, broad trigger text increases the chance that this screen-capture skill is auto-invoked in contexts where sensitive screens may be captured unnecessarily, creating privacy and surveillance risk disproportionate to the declared function.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The statement that users can trigger this scenario via natural-language instructions is too vague for a tool that can capture screen contents. In agentic systems, vague natural-language invocation broadens the activation surface and may allow unrelated prompts to be interpreted as authorization to take screenshots, exposing confidential on-screen information.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill presents itself as a local-only screenshot/OCR tool, yet its documented interface includes a callback_url for asynchronous notifications. That expands the trust boundary from purely local processing to possible outbound network communication, which can enable data exfiltration, SSRF-like behavior, or silent transmission of screenshot metadata/results if an agent implements the documented callback behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation states that the skill does not involve external APIs, but elsewhere it describes callback-based behavior and network troubleshooting steps such as ping/connectivity checks. This inconsistency can mislead users and agent frameworks into treating the skill as local-only while it may trigger network activity, reducing informed consent and weakening security review of a screen-capture tool that handles sensitive content.

Content

No source excerpt is available for this finding.