ClawHub
Back to skill

Security audit

Rebind Computer Use

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real desktop-control skill, but it gives the agent very broad host control through an unscoped scripting interface.

Install only if you are comfortable giving this agent full control of the connected desktop and broad local scripting access, including file, network, shell, clipboard, process, and registry operations. Prefer an isolated machine or profile, protect the Rebind relay with an auth token, and consider pinning the MCP package version before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The documented run_lua surface exposes powerful non-GUI capabilities including file access, network access, environment reads, clipboard access, process control, and macros. In a skill presented as computer-use via keyboard/mouse, this creates a much broader capability set that could be abused to exfiltrate data, execute commands, or bypass expected user-visible interaction and verification.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The guidance explicitly normalizes launching applications and opening URLs through System.Exec/System.ExecDetached instead of limiting the skill to user-observable input replay. That broadens the trust boundary from input emulation to arbitrary program execution, enabling actions outside the visible GUI workflow and increasing the chance of misuse or unintended command execution.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The skill claims there is 'no automation API to detect,' yet it also documents a rich automation interface via run_lua and related control functions. This misleading framing can cause operators to underestimate the true capability and risk of the tool, reducing scrutiny around a surface that can automate far more than simple hardware input.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
- **Skill:** `rebind-computer-use/SKILL.md` — teaches the agent when and how to
  drive the tools.
- **Tools:** the [`@rebind.gg/mcp-server`](https://www.npmjs.com/package/@rebind.gg/mcp-server)
  MCP server — `screenshot`, `zoom`, verified `click`, `type`, `key`, `scroll`,
  window control, `calibrate`.
Confidence
95% confidence
Finding
The README explicitly advertises broad GUI-control capabilities through an MCP server, including screenshot capture, keyboard input, mouse clicks, scrolling, and window control, with no meaningful scope limitation described here. In the context of an agent skill, this enables full interaction with the host desktop and can be abused to exfiltrate sensitive data, operate security-sensitive applications, or bypass protections that block synthetic input, making the unrestricted access materially dangerous if the skill is misused or compromised.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.