Security audit
Security checks for vulnerabilities and agentic risk
This Windows desktop-control skill is mostly purpose-aligned, but it gives broad desktop authority and contains concrete safety gaps that could let a caller terminate unintended processes or execute PowerShell through clipboard input.
Review carefully before installing. Use only in a trusted, local Windows environment, avoid running it as administrator, and do not let untrusted prompts or content invoke clipboard, keyboard, mouse, screenshot, or process-kill actions. The publisher should fix the clipboard command injection, enforce the process allowlist for PIDs, add explicit confirmations for high-impact actions, and pin dependencies before broad use.
scripts/desktop_ctrl.py:184Numeric PID Input Bypasses the Process Termination Allowlist
scripts/desktop_ctrl.py:231PowerShell Command Injection Through Clipboard Text
SKILL.md:35Unpinned Python Dependencies Create a Supply-Chain Risk
scripts/desktop_ctrl.py:57Screenshot Data Is Unnecessarily Encoded and Included in Command Output
The skill exposes powerful shell-backed desktop control capabilities, including screenshots, input simulation, process management, and clipboard access, but does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope declarations increases the chance that the skill can be invoked with broader-than-expected authority, making unauthorized system interaction or privacy-invasive actions easier.
The manifest description is written to activate on Chinese-language user requests and does not indicate any language choice or opt-in. This can violate language/locale policy when a skill implicitly requires a specific language without documenting that constraint or offering alternatives.
The skill captures screenshots and writes them to disk without any built-in disclosure, confirmation, or privacy guardrails. In a desktop-control context this is especially sensitive because screenshots can expose credentials, financial data, private chats, and other on-screen secrets, and the on-disk copy creates lasting forensic exposure.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
try:
# 使用简化的命令 - 只获取前10个进程
ps = "(Get-Process | Select-Object -First 10 | ConvertTo-Json -Compress)"
result = subprocess.run(
["powershell", "-ExecutionPolicy", "Bypass", "-NoProfile", "-Command", ps],
capture_output=True, text=True, timeout=10
)
Automated typing, key presses, and hotkeys can drive arbitrary actions in whatever application currently has focus, including sending messages, changing settings, approving prompts, or exfiltrating data. Without user-facing safeguards, this creates a powerful confused-deputy risk in a desktop-control skill.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Select-Object -First {top} Id, ProcessName, CPU, WorkingSet64 |
ConvertTo-Json
'''
result = subprocess.run(
["powershell", "-ExecutionPolicy", "Bypass", "-NoProfile", "-Command", ps],
capture_output=True, text=True, timeout=30
)
Process termination is a destructive operation, and this code performs it without explicit confirmation or contextual warning. Even with a process-name allowlist, terminating browsers, editors, or runtimes can cause data loss, interrupt work, or shut down security-relevant software inappropriately.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
return {"success": False, "error": f"只允许结束白名单进程: {', '.join(ALLOWED_PROCESSES)}"}
ps = f'Stop-Process -Name "{name_or_pid}" -Force -ErrorAction Stop'
subprocess.run(["powershell", "-ExecutionPolicy", "Bypass", "-NoProfile", "-Command", ps], check=True, timeout=10)
return {"success": True}
except subprocess.CalledProcessError as e:
return {"success": False, "error": f"结束进程失败: {e}"}
The skill metadata describes screenshot, window, input, process, and system-info features, but the implementation can also read and modify clipboard contents. Undisclosed clipboard access is dangerous because clipboards often hold passwords, tokens, personal messages, and other sensitive transient data that users do not expect this skill to access.
Clipboard reads occur without any user-facing warning or consent flow. Because clipboard contents frequently contain secrets and are not always visible on screen, silent access creates a significant privacy and credential-exposure risk in this skill context.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
return {"success": True, "text": "(无文本)"}
except:
ps = 'Get-Clipboard'
result = subprocess.run(
["powershell", "-Command", ps],
capture_output=True, text=True
)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
return {"success": True, "text": "(无文本)"}
except:
ps = 'Get-Clipboard'
result = subprocess.run(
["powershell", "-Command", ps],
capture_output=True, text=True
)
clipboard_set builds a PowerShell command by embedding user-controlled text inside double quotes, but only escapes double quotes and backticks. PowerShell still performs variable and subexpression expansion inside double-quoted strings, so input like $(...) or $env:... can alter command behavior or trigger unintended command execution.
# 转义特殊字符防止注入
escaped_text = text.replace('"', '\\"').replace('`', '``')
ps = f'Set-Clipboard -Value "{escaped_text}"'
subprocess.run(["powershell", "-ExecutionPolicy", "Bypass", "-NoProfile", "-Command", ps], check=True, timeout=10)
return {"success": True}
except Exception as e:
return {"success": False, "error": str(e)}
The skill advertises clipboard write support without warning that it can overwrite user clipboard contents, which may disrupt workflows or replace sensitive copied data. In a desktop-control skill, clipboard mutation is more sensitive because it directly alters user state and can be used to stage unintended pastes into other applications.
The module description and many user-facing strings are written in Chinese, which imposes a language choice on users without any opt-in or explanation that the skill is intended only for a Chinese-speaking context. This is a natural-language locale policy concern because the file does not offer alternatives or document the restriction.
The execute_command method is documented as disabled and always returns an error, indicating command execution is not a real capability. However, the CLI help text still presents 'exec - 执行命令' as an available command, which contradicts the documented intent and misrepresents the skill's behavior.