Macos Click

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:38 PM UTC
• Version: 1.0.0

Overview

This skill does what it says, but it gives an agent broad macOS screen-control power with weak safety boundaries and an understated privacy warning.

Install only if you are comfortable letting an agent control the Mac like a real user through Accessibility permission. Use it on narrow, supervised tasks, verify coordinates with screenshots before acting, and avoid using it around password prompts, payment flows, destructive dialogs, private documents, or apps where an accidental click could make irreversible changes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Context Leakage

High

• Category: Data Exfiltration

Content

CGEvent opens the dialog. AppleScript navigates it. They're a team:

```bash
# Step 1: CGEvent click opens a file upload dialog
python3 scripts/macos_click.py click 750 400

# Step 2: AppleScript navigates the native file dialog

• Confidence: 85% confidence
• Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly relies on shell-capable actions such as running python3, osascript, screencapture, sleep, and pbcopy, yet it declares no tool scope or permissions. In an agent setting, this creates an authorization gap where a consumer may not realize the skill can drive OS-level input and shell commands, increasing the risk of unintended system interaction or abuse.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The documentation markets the skill as a single zero-dependency CGEvent script, but the operational workflow depends on additional shell-based capabilities including AppleScript, screenshots, and clipboard manipulation. This scope mismatch can mislead operators and policy engines about what the skill actually does, causing it to be approved in contexts where broader automation powers are unsafe.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The FAQ claims the skill does not read screen content or access data, but earlier sections explicitly instruct screenshot capture and window inspection. This contradiction can cause users or agents to underestimate privacy impact and grant access under false assumptions, especially because screenshots and window metadata may expose sensitive information.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This skill performs hardware-level synthetic clicks and keystrokes against arbitrary apps and dialogs, but the documentation lacks a clear warning that such actions can trigger destructive operations, approve prompts, overwrite text, or alter files. In this context, omission of that warning is security-relevant because the entire purpose of the skill is to bypass higher-level safeguards and interact directly with system UI.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The module docstring and manifest-aligned description state this script provides 'mouse & keyboard automation' and mention dialog automation via AppleScript, but the implemented commands are limited to mouse click/move/drag operations and querying window metadata. There is no keyboard event generation or dialog automation behavior in this file, so the stated capability does not match the actual code behavior.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This code generates hardware-level input events that macOS and target applications may treat as real user actions, allowing clicks, drags, and right-clicks without any runtime confirmation or safety interlock. In an agent skill context, that makes accidental or adversarially induced destructive actions more dangerous because the automation can activate arbitrary UI elements, approve prompts, or manipulate sensitive applications.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

end tell
    end tell
    '''
    result = subprocess.run(
        ["osascript", "-e", script], capture_output=True, text=True
    )
    if result.returncode != 0:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

end tell
    end tell
    '''
    result = subprocess.run(
        ["osascript", "-e", script], capture_output=True, text=True
    )
    if result.returncode != 0:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Low

• Confidence: 75% confidence
• Finding: The skill is described primarily as hardware-level mouse, keyboard, and dialog automation for cases where browser clicks fail. The additional capability to inspect an application's front window and enumerate all of its windows/titles is not clearly required just to perform native click automation and exposes UI metadata beyond simple input simulation.