Macos Click

• Analyzed: May 11, 2026, 4:42 AM
• Findings: 1
• Version: 1.0.0
• Hash: 54b1f0af2818a6689a6d9cc6a9f378756161a005e6380e56d4dea58dffcbd5e5
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is classified as suspicious due to its reliance on powerful system-level commands and direct execution of `osascript` and shell commands, which present a significant prompt injection and shell injection risk for an AI agent. While the `scripts/macos_click.py` file includes an `_sanitize_app_name` function to mitigate AppleScript injection for its specific arguments, the `SKILL.md` documentation explicitly demonstrates and encourages direct execution of `osascript` and `/usr/sbin/screencapture` via shell commands. These capabilities, though intended for legitimate macOS automation, could be easily leveraged for data exfiltration, unauthorized command execution, or other malicious activities if the agent's prompts are compromised.