TuriX Computer Use

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:09 AM UTC
• Version: 1.0.8

Overview

The skill is a coherent macOS desktop automation helper, but it asks for broad screen-control permissions and relies on unpinned external code that defines the real behavior.

Review this skill carefully before installing. Use it only in a dedicated, low-sensitivity macOS session, avoid account sign-ups, OAuth, financial, messaging, admin, or confidential-data workflows unless you are supervising each step, pin and review the exact TuriX-CUA commit and dependency set, grant the narrowest possible Screen Recording and Accessibility permissions, and revoke those permissions after use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: README.md:25
• Finding: Overly Broad Accessibility and Screen Recording Permission Guidance<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 25-35 **Vulnerability Type**: Least-privilege violation through authorization of general-purpose runtimes **Risk Level**: High ### Vulnerable Code Snippet ```markdown ### 2. Mandatory Permissions macOS security requires explicit permission for background processes to capture the screen. 1. **Screen Recording:** - Go to **System Settings > Privacy & Security > Screen Recording**. - Add **Terminal**, **VS COde**. - Add `/your_install_dir/bin/node` (The binary running Clawdbot, example:`/opt/homebrew/bin/node`). - Ensure the toggle is **ON**. 2. **Accessibility:** - Go to **System Settings > Privacy & Security > Accessibility**. - Add **Terminal**, **VS Code**, **Node**, and `/usr/bin/python3`. ``` ### Technical Analysis The installation instructions direct users to grant macOS Screen Recording and Accessibility permissions to multiple general-purpose applications and runtimes, including Terminal, VS Code, Node, and `/usr/bin/python3`. Accessibility authorization permits an approved process to synthesize keyboard and mouse input and interact with other applications. Screen Recording authorization permits observation of potentially sensitive content displayed by other applications. Granting these privileges to general-purpose interpreters broadens the trust boundary beyond the specific TuriX automation component. Any unrelated, malicious, or compromised program executed under an authorized interpreter may consequently inherit the interpreter's powerful desktop access. Although visual automation legitimately requires certain macOS permissions, the documentation does not constrain authorization to a dedicated, narrowly scoped executable or explain which individual components strictly require each permission. ### Attack Path 1. A user follows the installation instructions and grants Accessibility or Screen Recording permission to Node, Python, Terminal, or VS Code. 2. T ...[truncated 1078 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Package or invoke TuriX through a dedicated, narrowly scoped launcher or signed application identity. 2. Grant Screen Recording and Accessibility permissions only to the specific component that performs desktop automation. 3. Remove blanket recommendations to authorize Terminal, VS Code, Node, and `/usr/bin/python3` unless each component is demonstrably required. 4. Document the minimum required permission for each executable and explain the security consequences. 5. Recommend revoking the permissions immediately when the automation capability is no longer needed. 6. Isolate the automation environment from unrelated scripts and packages, and avoid using the authorized interpreter for general-purpose workloads. 7. Provide verification and revocation instructions so users can audit authorized applications in macOS Privacy & Security settings. ]]>

T08 · Insecure Dependencies

Error

• Location: README.md:16
• Finding: Unpinned External Repository and Python Dependencies Define Effective Skill Behavior<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 16-22 **Vulnerability Type**: Mutable and unverified third-party dependency installation **Risk Level**: High ### Vulnerable Code Snippet ```markdown ### 1. TuriX Core Setup Set up TuriX following the official repository: `https://github.com/TurixAI/TuriX-CUA` ```bash conda activate your_env pip install -r requirements.txt ``` ``` ### Technical Analysis The Skill delegates its core behavior to the external `TurixAI/TuriX-CUA` repository. The instructions do not specify a reviewed commit hash, immutable release artifact, checksum, dependency lockfile, or package hash verification procedure. The local launcher subsequently executes `examples/main.py` from that external project. Consequently, reviewing this Skill package alone does not establish the behavior of the code ultimately executed. The effective payload may change when the external repository or its dependency declarations change. Running `pip install -r requirements.txt` without a hash-locked dependency set also leaves installation dependent on mutable package indexes and the contents of an externally supplied requirements file. A compromised upstream repository, maintainer account, release process, or transitive package could introduce arbitrary code. ### Attack Path 1. A user follows the README and obtains the external TuriX-CUA repository without checking out a known reviewed commit. 2. An attacker compromises the upstream repository, a maintainer account, or one of the dependencies referenced by `requirements.txt`. 3. The attacker adds malicious Python code or changes a dependency to a malicious version. 4. The user installs the mutable dependency set using `pip install -r requirements.txt`. 5. The supplied launcher executes the external project's `examples/main.py` through the Conda environment. 6. The malicious code runs with the current user's filesystem access and any Screen Recording or Accessibility permissions gr ...[truncated 698 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin TuriX-CUA to a specific reviewed commit hash or an immutable, versioned release. 2. Publish the exact supported upstream version in the Skill documentation and launcher validation logic. 3. Verify release artifacts with a cryptographic checksum or signature before installation. 4. Replace an unconstrained requirements installation with a fully resolved lockfile containing exact versions and package hashes. 5. Install dependencies with hash enforcement, such as `pip install --require-hashes -r requirements.lock`. 6. Review direct and transitive dependencies and automate vulnerability and provenance checks. 7. Execute TuriX in a dedicated environment with only the filesystem and desktop permissions required for the intended task. 8. Fail closed when the installed TuriX revision does not match the documented and audited revision. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The example instructs the agent to use Safari to visit a site and sign up with a Google account, which normalizes delegating account-authentication and identity-linked actions to a GUI automation agent without any privacy or credential-safety warning. Because this skill is specifically designed to observe the screen and control the desktop with elevated macOS permissions, this use case raises substantial risk of exposing authentication flows, interacting with personal accounts, or approving unintended consent screens.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

**❌ Avoid:**
- Vague instructions: "Help me" or "Fix this"
- Impossible actions: "Delete all files"
- Tasks requiring system-level permissions without warning

**💡 Best Practices:**
1. Be specific about the target application

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly promotes desktop GUI automation as the skill’s core function but does not warn that such automation can click through prompts, alter settings, send messages, or otherwise perform sensitive and potentially irreversible actions on the user’s machine. In the context of a computer-use agent with screen recording and accessibility permissions, omission of safety boundaries materially increases the risk of unsafe or overbroad use.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill enables autonomous desktop control and its documentation clearly references environment manipulation, reading logs, and writing configuration and output files, but it declares no explicit tool scope or permission boundaries. In a desktop-control skill, missing scope is dangerous because it obscures what the agent may access or modify, increasing the chance of unintended file access, credential exposure, or unsafe actions across the local machine.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill presents autonomous macOS desktop control as a normal capability but does not prominently warn that the agent can observe on-screen content, interact with logged-in services, and act through the user's existing account sessions. That omission is security-relevant because users may invoke the skill without understanding that emails, messages, passwords, financial data, and admin dialogs could be exposed or acted upon.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation instructs users to grant screen-recording and accessibility-related permissions, including a workaround using AppleScript, without a clear privacy/security warning about the breadth of access those permissions enable. These permissions effectively allow observation of screen contents and UI control, which can expose confidential data and permit high-impact actions if the agent behaves incorrectly or is misused.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The embedded Python rewrites CONFIG_FILE in place, changing task, resume, and feature-flag settings. Although it prints a success message after writing, there is no prior warning or confirmation that a user-supplied or default config file will be modified on disk.

Static analysis

No suspicious patterns detected.