Windows 桌面控制

• Outcome: Review
• Latest audit: May 29, 2026 at 9:24 PM UTC
• Version:
  1.0.3

Overview

This Windows desktop-control skill mostly matches its stated purpose, but it needs review because it gives an agent broad local control and contains unsafe clipboard and process-kill behavior.

Install only if you intentionally want an agent to control your Windows desktop. Treat screenshots and clipboard reads as sensitive, review any click/type/hotkey/kill action before it runs, and avoid using clipboard set with untrusted text until the PowerShell command construction is fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return {"success": False, "error": f"只允许结束白名单进程: {', '.join(ALLOWED_PROCESSES)}"}
                ps = f'Stop-Process -Name "{name_or_pid}" -Force -ErrorAction Stop'
            
            subprocess.run(["powershell", "-ExecutionPolicy", "Bypass", "-NoProfile", "-Command", ps], check=True, timeout=10)
            return {"success": True}
        except subprocess.CalledProcessError as e:
            return {"success": False, "error": f"结束进程失败: {e}"}

• Confidence: 82% confidence
• Finding: subprocess.run(["powershell", "-ExecutionPolicy", "Bypass", "-NoProfile", "-Command", ps], check=True, timeout=10)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 转义特殊字符防止注入
            escaped_text = text.replace('"', '\\"').replace('`', '``')
            ps = f'Set-Clipboard -Value "{escaped_text}"'
            subprocess.run(["powershell", "-ExecutionPolicy", "Bypass", "-NoProfile", "-Command", ps], check=True, timeout=10)
            return {"success": True}
        except Exception as e:
            return {"success": False, "error": str(e)}

• Confidence: 92% confidence
• Finding: subprocess.run(["powershell", "-ExecutionPolicy", "Bypass", "-NoProfile", "-Command", ps], check=True, timeout=10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises and documents shell-invoked capabilities via Python and PowerShell, but does not declare corresponding permissions. This weakens policy enforcement and user awareness, especially for a desktop-control skill that can capture screens, inspect processes, and interact with the system.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared purpose omits clipboard access/modification even though the skill explicitly supports reading and writing clipboard contents. Clipboard data often contains passwords, tokens, PII, or other sensitive material, so undocumented access materially expands the skill's effective data exposure beyond what a user may expect.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill implements clipboard read/write capabilities that are not disclosed in the manifest/description, expanding its effective privilege beyond what a user or reviewer would expect. Hidden data-access features are dangerous because they can expose secrets such as passwords, tokens, copied documents, or alter pasted content without informed consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation promotes screenshot and clipboard operations without warning that they may capture secrets visible on screen or stored in the clipboard, such as passwords, MFA codes, customer data, or proprietary information. In a desktop-control context, this omission is especially risky because the skill is specifically designed to access highly sensitive user environment data.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill captures screenshots and writes them to disk without any user-facing warning, consent, or disclosure. In a desktop-control skill, screenshot access is inherently sensitive because it can expose emails, chats, passwords, documents, MFA prompts, and other on-screen secrets, and persisting images increases the privacy and retention risk.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: Clipboard reads access highly sensitive user data with no warning or consent mechanism. In practice, clipboards commonly contain credentials, API keys, personal messages, wallet addresses, and confidential text, making silent retrieval a significant privacy and security risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Clipboard modification can silently alter what the user pastes into other applications, enabling deception, workflow corruption, or replacement of legitimate content with malicious text. Because this occurs without disclosure or confirmation, users may not realize the clipboard was changed.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Process termination is a destructive action, and this implementation performs it without user confirmation. Even with a name allowlist, the feature can close browsers, editors, Python/node processes, or other active apps, causing denial of service or loss of unsaved work; PID-based termination further weakens the safety model.

VirusTotal

66/66 vendors flagged this skill as clean.