Security audit

Rebind Computer Use

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed computer-control integration, but it grants very broad host access through an unpinned remote MCP package that users should review carefully before installing.

Install only if you trust Rebind and the @rebind.gg MCP package publisher, and preferably pin or review the MCP server version before use. Run it from a low-privilege account or sandbox where possible, avoid exposing sensitive files, clipboard contents, credentials, or environment variables, and require explicit confirmation before any action that sends data, changes accounts, deletes content, posts publicly, or makes purchases.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: install.sh:24
Finding: Unpinned MCP Dependency Is Downloaded and Executed at Runtime
Content: View full analysis
Vulnerability Details

File Location: install.sh:24-28,40; SKILL.md:33-36; README.md:24,39-43; mcp.example.json:5-6
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: High

Vulnerable Code

install.sh:24-28:

bash
# @rebind.gg/mcp-server ships via npm; bunx fetches it on demand. # --no-probe: the default probe spawns the server and fails if the relay isn't # running yet; the selftest below is the real verifier. if openclaw mcp add rebind --no-probe \ --command bunx --arg @rebind.gg/mcp-server \

install.sh:40:

bash
bunx @rebind.gg/mcp-server --selftest || die "Rebind relay not reachable on ws://127.0.0.1:19561.

SKILL.md:33-36:

sh
openclaw mcp add rebind --no-probe \ --command bunx --arg @rebind.gg/mcp-server \ --env REBIND_URL=ws://127.0.0.1:19561 openclaw config set skills.entries.rebind-computer-use.env.REBIND_URL ws://127.0.0.1:19561

README.md:39-43:

sh
openclaw skills install @usinput/rebind-computer-use openclaw mcp add rebind --no-probe \ --command bunx --arg @rebind.gg/mcp-server \ --env REBIND_URL=ws://127.0.0.1:19561 openclaw config set skills.entries.rebind-computer-use.env.REBIND_URL ws://127.0.0.1:19561

mcp.example.json:5-6:

json
"command": "bunx", "args": ["@rebind.gg/mcp-server"],

Technical Analysis

The installation instructions and configuration execute @rebind.gg/mcp-server through bunx without specifying an exact package version or verifying an integrity digest. Package resolution can therefore select a release different from the one reviewed during this audit.

The installer also invokes the package directly during its self-test. Registration causes the same remotely resolved package to be executed again whenever OpenClaw starts the MCP server. Trust is consequently delegated to the package registry, package publisher account, DNS and TLS infrastructure, and every future package release.

There is no evidence in the reviewed ...[truncated 1426 chars]
Remediation: View remediation
Remediation Suggestions

Replace every unversioned package reference with an exact, audited version, for example:

bash
bunx @rebind.gg/mcp-server@X.Y.Z

Apply the same exact version in install.sh, SKILL.md, README.md, and mcp.example.json so that installation and runtime behavior remain consistent.

Prefer installing the dependency from a lockfile rather than resolving it dynamically during every launch.

Verify the package archive against a trusted cryptographic digest before execution.

Consider vendoring a reviewed release or distributing a signed executable through a controlled release channel.

Disable automatic version drift. Upgrade only through an explicit process that includes source review, integrity validation, and security testing.

Use package provenance or signature verification where supported, and restrict package publication to accounts protected by strong multifactor authentication.

Execute the MCP server inside a sandbox with only the filesystem, network, and process permissions required for its documented operation.

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:93
Finding: Computer-Control Skill Exposes Broad Host APIs Without Enforced Least-Privilege Boundaries
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:93-96
Vulnerability Type: Excessive system, file, environment, clipboard, network, and process capabilities
Risk Level: High

Vulnerable Code

SKILL.md:93-96:

markdown
- `run_lua(source)` — run a Luau script on the machine and get its `return` value as JSON. Namespaces: System, HID, Input, Screen, Window, Process, File, Clipboard, Net, Macro, Env, Log. Your primary tool for anything deterministic.

Related instructions at SKILL.md:116-119 rely on policy rather than technical enforcement:

markdown
`System.Exec`/`System.ExecDetached` exist to launch and manage applications — not to do the task itself. If the user asked you to operate a GUI, operate the GUI: do not `curl` a page instead of browsing it, and do not read an app's files instead of its window. Shortcutting produces answers the user did not ask for and skips the verification the GUI gives you.

Technical Analysis

The skill is presented primarily as a keyboard, mouse, screenshot, and window-control facility. Its run_lua interface nevertheless exposes broader namespaces for process execution, filesystem access, clipboard access, environment-variable access, and networking.

These capabilities cross several privilege boundaries that are not inherently necessary for basic GUI interaction. In particular:

File can expose local documents and application data.

Clipboard can expose copied credentials, tokens, or private content.

Env can expose secrets supplied through environment variables.

Process and System.Exec can start local programs or commands.

Net can provide an outbound transmission channel.

The skill text discourages using execution and file APIs as shortcuts, but this is a behavioral instruction rather than an enforced access-control mechanism. It does not prevent a compromised agent context, prompt injection, erroneous tool selection, or malicious MCP implementation from invoking t ...[truncated 1412 chars]
Remediation: View remediation
Remediation Suggestions

Expose only the namespaces required for the requested task. Basic computer use should normally be limited to HID input, screenshots, window management, and narrowly scoped application launching.

Remove File, Clipboard, Env, and Net from the default tool surface. Enable them only through separate, explicitly authorized tools.

Replace general-purpose process execution with an allowlisted launcher that permits only approved applications and rejects arbitrary commands, shells, interpreters, and user-controlled arguments.

Enforce restrictions inside the MCP server rather than relying solely on skill instructions.

Require explicit user approval before:

Reading files, clipboard contents, or environment variables.

Starting a command or unapproved process.

Making outbound network requests.

Run the MCP server in an operating-system sandbox with restricted filesystem access, a minimal environment, no inherited credentials, and deny-by-default outbound networking.

Add provenance checks so instructions found in GUI content cannot authorize sensitive host operations.

Record security-relevant API use in an audit log, including the invoked namespace, operation, destination, and approval decision.

Separate GUI automation from administrative capabilities into distinct MCP services so that ordinary computer-use sessions never receive high-risk APIs.

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description claims end-user functionality for controlling the computer through real USB-backed keyboard and mouse input. However, this code chunk does not implement or exercise desktop control, input injection, browsing, screenshotting, or form interaction. Its primary purpose is installation and configuration of the skill and MCP server integration. While this setup may support the described skill, the actual behavior of the supplied code is materially different from the declared purpose, so this is a mismatch.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install.sh (reported line 18)May include surrounding context.
sh
# 2. copy the skill (this script lives alongside SKILL.md) SKILLS="${OPENCLAW_HOME:-$HOME/.openclaw}/skills" mkdir -p "$SKILLS/rebind-computer-use" cp SKILL.md "$SKILLS/rebind-computer-use/" echo "skill installed to $SKILLS/rebind-computer-use"

Missing User Warnings