Computer Control (tarsx)

• Outcome: Review
• Latest audit: Sep 24, 2026 · 1:38 AM UTC
• Version: 1.0.1

Overview

This desktop automation skill is mostly coherent, but it grants very broad live computer control and includes an unscoped AppleScript escape hatch plus a risky Linux app launcher.

Review this before installing. It is intended to control your desktop, so only use it with agents and prompts you trust. Be especially cautious with `tarsx osa`, URL opening, and Linux app names, and do not let it enter passwords or one-time codes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Exposing arbitrary AppleScript execution grants much broader control than simple clicking and typing, including automation of other applications, file operations, system interrogation, and chaining into shell execution via AppleScript facilities. In context, this turns a GUI helper into a near-general macOS automation interface with few stated limits.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly relies on powerful shell-backed capabilities (`install.sh`, CLI invocation, GUI control) but does not declare any explicit tool scope or permissions boundaries. That omission makes the skill easier to invoke with broader-than-expected execution rights and reduces reviewability for operators deciding whether the skill should be allowed.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger scope is very broad and includes common phrases like opening apps, clicking, typing, screenshots, and general computer control. Because this skill can perform high-impact GUI and automation actions, ambiguous invocation increases the chance of unintended activation and execution in situations where a narrower skill or direct confirmation should be used.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Allowing `tarsx open <https://url>` extends the skill from local desktop automation into launching arbitrary network resources in the default browser or handler. That can be abused to drive users to phishing pages, trigger custom URI handlers, or bypass intended restrictions on web access through an apparently local-control skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The `osa` command exposes direct AppleScript execution from CLI input with no validation, restriction, confirmation, or safety interlock. In the context of a computer-control skill, this is especially dangerous because AppleScript can automate apps, read or manipulate local data, and invoke shell commands, effectively granting arbitrary code-like execution through a higher-level interface.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This skill exposes broad shell/app execution and GUI control primitives with no built-in consent gate, scope restriction, or high-risk action disclosure. In the context of a computer-control skill, that materially increases the chance of covert or unsafe actions such as launching apps, interacting with sensitive windows, taking screenshots, and driving the desktop in ways the user may not anticipate.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

return `clicked ${n}x (osascript)`;
  }
  if (PLATFORM === 'linux') {
    if (!(await has('xdotool'))) fail('xdotool not installed (sudo apt install xdotool)');
    const b = button === 'right' ? 3 : 1;
    await sh('xdotool', ['mousemove', String(x), String(y)]);
    return sh('xdotool', ['click', '--repeat', String(n), '--delay', '80', String(b)]);

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The exported function is named and positioned as a mouse-move primitive, but the macOS fallback path executes `tell application "System Events"` with no movement command. That means the fallback does not perform the advertised action and contradicts the function's clear intent.

Session Persistence

Medium

• Category: Rogue Agent

Content

return sh(PLATFORM === 'darwin' ? '/usr/bin/open' : 'xdg-open', [url]);
  }
  if (PLATFORM === 'darwin') return sh('/usr/bin/open', ['-a', name]);
  if (PLATFORM === 'linux') return sh('sh', ['-c', `nohup ${name} >/dev/null 2>&1 &`]);
  return sh('powershell', ['-NoProfile', '-Command', `Start-Process '${name}'`]);
}

• Confidence: 95% confidence
• Finding: On Linux, `openApp` launches `${name}` via `sh -c` and backgrounds it with `nohup`, causing the spawned process to persist independently of the invoking session. In a computer-control skill, this makes actions less observable and easier to abuse for unattended or lingering execution, especially when combined with untrusted `name` input.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The manifest text explicitly specifies "Ukrainian triggers" but does not state that language selection is optional or that the skill is intentionally limited to a Ukrainian-language deployment. This can conflict with language/locale policy expectations when a skill imposes a locale-specific interaction pattern without user opt-in.

Missing User Warnings

Low

• Confidence: 73% confidence
• Finding: The `click` command triggers mouse clicks, including right-click, double-click, and repeated clicks, which can activate controls or perform destructive actions in other applications. Although the command name indicates clicking, there is no explicit safety warning in this file that the action targets the current desktop/UI and may change system or application state.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The `type` command injects text into the current UI context via `core.typeText`, which can affect user data by entering content into whichever application is focused. The file includes no warning or explanatory comment at the command implementation indicating that input will be sent to the active window.

Description-Behavior Mismatch

Low

• Confidence: 87% confidence
• Finding: The configuration object exposes `screenshotFormat`, suggesting the output format is configurable, but the macOS screenshot implementation hardcodes `-t png`. This creates a mismatch between the documented/configured behavior and what the code actually does.

Static analysis

No suspicious patterns detected.