TuriX Computer Use

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:09 AM UTC
• Version: 1.0.8

Overview

The skill is a coherent macOS desktop automation helper, but it asks for broad screen-control permissions and relies on unpinned external code that defines the real behavior.

Review this skill carefully before installing. Use it only in a dedicated, low-sensitivity macOS session, avoid account sign-ups, OAuth, financial, messaging, admin, or confidential-data workflows unless you are supervising each step, pin and review the exact TuriX-CUA commit and dependency set, grant the narrowest possible Screen Recording and Accessibility permissions, and revoke those permissions after use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: README.md:25

Finding

Overly Broad Accessibility and Screen Recording Permission Guidance

Content

View full analysis

Privacy & Security > Screen Recording**. - Add **Terminal**, **VS COde**. - Add `/your_install_dir/bin/node` (The binary running Clawdbot, example:`/opt/homebrew/bin/node`). - Ensure the toggle is **ON**. 2. **Accessibility:** - Go to **System Settings > Privacy & Security > Accessibility**. - Add **Terminal**, **VS Code**, **Node**, and `/usr/bin/python3`. ``` ### Technical Analysis The installation instructions direct users to grant macOS Screen Recording and Accessibility permissions to multiple general-purpose applications and runtimes, including Terminal, VS Code, Node, and `/usr/bin/python3`. Accessibility authorization permits an approved process to synthesize keyboard and mouse input and interact with other applications. Screen Recording authorization permits observation of potentially sensitive content displayed by other applications. Granting these privileges to general-purpose interpreters broadens the trust boundary beyond the specific TuriX automation component. Any unrelated, malicious, or compromised program executed under an authorized interpreter may consequently inherit the interpreter's powerful desktop access. Although visual automation legitimately requires certain macOS permissions, the documentation does not constrain authorization to a dedicated, narrowly scoped executable or explain which individual components strictly require each permission. ### Attack Path 1. A user follows the installation instructions and grants Accessibility or Screen Recording permission to Node, Python, Terminal, or VS Code. 2. T ...[truncated 1078 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: README.md:16

Finding

Unpinned External Repository and Python Dependencies Define Effective Skill Behavior

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The example instructs the agent to use Safari to visit a site and sign up with a Google account, which normalizes delegating account-authentication and identity-linked actions to a GUI automation agent without any privacy or credential-safety warning. Because this skill is specifically designed to observe the screen and control the desktop with elevated macOS permissions, this use case raises substantial risk of exposing authentication flows, interacting with personal accounts, or approving unintended consent screens.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

**❌ Avoid:**
- Vague instructions: "Help me" or "Fix this"
- Impossible actions: "Delete all files"
- Tasks requiring system-level permissions without warning

**💡 Best Practices:**
1. Be specific about the target application

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly promotes desktop GUI automation as the skill’s core function but does not warn that such automation can click through prompts, alter settings, send messages, or otherwise perform sensitive and potentially irreversible actions on the user’s machine. In the context of a computer-use agent with screen recording and accessibility permissions, omission of safety boundaries materially increases the risk of unsafe or overbroad use.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill enables autonomous desktop control and its documentation clearly references environment manipulation, reading logs, and writing configuration and output files, but it declares no explicit tool scope or permission boundaries. In a desktop-control skill, missing scope is dangerous because it obscures what the agent may access or modify, increasing the chance of unintended file access, credential exposure, or unsafe actions across the local machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill presents autonomous macOS desktop control as a normal capability but does not prominently warn that the agent can observe on-screen content, interact with logged-in services, and act through the user's existing account sessions. That omission is security-relevant because users may invoke the skill without understanding that emails, messages, passwords, financial data, and admin dialogs could be exposed or acted upon.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation instructs users to grant screen-recording and accessibility-related permissions, including a workaround using AppleScript, without a clear privacy/security warning about the breadth of access those permissions enable. These permissions effectively allow observation of screen contents and UI control, which can expose confidential data and permit high-impact actions if the agent behaves incorrectly or is misused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The embedded Python rewrites CONFIG_FILE in place, changing task, resume, and feature-flag settings. Although it prints a success message after writing, there is no prior warning or confirmation that a user-supplied or default config file will be modified on disk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.