Security audit
Security checks for vulnerabilities and agentic risk
This skill openly provides powerful local computer-control features, but its unrestricted AppleScript and shell-backed app launching create broad authority that users should review carefully before installing.
Install only if you are comfortable granting a local helper app permission to view the screen and control the computer. Avoid using the arbitrary AppleScript command except for commands you have reviewed, and be aware the Linux app launcher path can interpret app names through a shell. Review the install files before running them because the helper app is written into ~/Applications/TarsX.app.
The osa command forwards arbitrary user-supplied script text to core.runApplescript, enabling unrestricted AppleScript execution. In the context of a computer-control skill, this is especially dangerous because AppleScript can drive applications, access files, trigger system actions, and potentially bypass safer higher-level controls intended by the skill interface.
runApplescript executes arbitrary AppleScript supplied by the caller, which on macOS can control applications, access files, trigger GUI actions, and invoke shell commands via AppleScript facilities. In the context of a computer-control skill, this effectively provides unrestricted code/automation execution with the permissions of the host process, making accidental misuse or malicious prompting especially dangerous.
The skill exposes powerful shell, file-write, and environment-access capabilities but does not declare any explicit tool scope or permission boundaries. In this particular skill, those capabilities are especially sensitive because it can install binaries, run AppleScript, take screenshots, and control the GUI, creating a broad path to arbitrary system interaction, data exposure, and unintended destructive actions if invoked improperly or repurposed by a prompt injection.
The script unconditionally creates and overwrites files inside a user application bundle path under ~/Applications, which can replace an existing app bundle without prompting the user. In the context of a computer-control skill that seeks Accessibility/AppleEvents permissions, silent replacement is more dangerous because it can modify a trusted GUI automation helper that may later receive powerful OS permissions.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p "$APP/Contents/MacOS"
cat > "$APP/Contents/Info.plist" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p "$APP/Contents/MacOS"
cat > "$APP/Contents/Info.plist" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p "$APP/Contents/MacOS"
cat > "$APP/Contents/Info.plist" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p "$APP/Contents/MacOS"
cat > "$APP/Contents/Info.plist" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p "$APP/Contents/MacOS"
cat > "$APP/Contents/Info.plist" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p "$APP/Contents/MacOS"
cat > "$APP/Contents/Info.plist" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p "$APP/Contents/MacOS"
cat > "$APP/Contents/Info.plist" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
The click, clickwin, type, and related input-control paths trigger real GUI interaction that can alter application state or send unintended input to the active system. Although these actions are the tool's purpose, this CLI file does not provide any explicit warning that commands will control the user's computer or affect open applications.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
return `clicked ${n}x (osascript)`;
}
if (PLATFORM === 'linux') {
if (!(await has('xdotool'))) fail('xdotool not installed (sudo apt install xdotool)');
const b = button === 'right' ? 3 : 1;
await sh('xdotool', ['mousemove', String(x), String(y)]);
return sh('xdotool', ['click', '--repeat', String(n), '--delay', '80', String(b)]);
The function is named and used as a mouse-move primitive, but on macOS without Quartz it executes tell application "System Events" with no movement command. That contradicts the function's documented intent and behavior expected by callers, because this branch does not actually move the mouse.
The function silently overwrites the system clipboard with arbitrary text before pasting non-ASCII content. In a computer-control skill, this is risky because clipboard contents may contain sensitive data such as passwords, tokens, or personal information, and replacing it without notice can cause data loss or unintended disclosure into another application.
On Linux, openApp launches arbitrary application names through sh -c with nohup ${name} ... &, combining background persistence with shell interpretation of untrusted input. If name is attacker-controlled, this allows shell metacharacter injection and detached execution of arbitrary commands, which is more dangerous in a skill explicitly designed to control the local machine.
return sh(PLATFORM === 'darwin' ? '/usr/bin/open' : 'xdg-open', [url]);
}
if (PLATFORM === 'darwin') return sh('/usr/bin/open', ['-a', name]);
if (PLATFORM === 'linux') return sh('sh', ['-c', `nohup ${name} >/dev/null 2>&1 &`]);
return sh('powershell', ['-NoProfile', '-Command', `Start-Process '${name}'`]);
}
The manifest describes screenshotting, mouse clicking/moving, typing, hotkeys, scrolling, app launching, window clicking, and AppleScript. This CLI also exposes doctor and probe diagnostic commands, and a mouse command that is not listed in the documented command set, extending behavior beyond what the manifest claims.
The comment at L226 says the 'Best backend' is cliclick, and the surrounding manifest/docs emphasize cliclick and osascript, but the actual fallback path at L237-L252 uses Quartz through Python to post HID events directly. This is not just omitted detail in the local comment; it changes the mechanism and permission model of how clicks are delivered.
This manifest description says the tool 'Works with Claude Desktop, Qoder, ZCode, Cursor and any MCP client' and broadly describes 'computer control' capabilities, but it does not define any specific invocation conditions, scope limits, or exclusion context. In a manifest file, this kind of broad natural-language description can make skill triggering or applicability ambiguous compared with a more constrained description.