Gui Control

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:17 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent GUI automation helper, but it can drive a live desktop, expose typed text and screenshots, and write persistent agent memory without enough user-control guardrails.

Install only if you intend to let the agent operate a visible desktop. Avoid using it for passwords, tokens, banking, admin consoles, private messages, or any workflow where an accidental keypress or screenshot leak would matter. Require explicit confirmation before typing, submitting forms, closing apps, or sending screenshots, and remove or constrain the MEMORY.md guidance before use.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/gui-helper.sh:34

Finding

Sensitive GUI Input Is Disclosed Through Standard Output

Content

View full analysis

Vulnerability Details

File Location: scripts/gui-helper.sh, lines 34–39
Vulnerability Type: Plaintext sensitive-data exposure through logging
Risk Level: Medium

bash

type)
  text="${1:-}"
  xdotool type --delay 50 "$text"
  echo "Typed: $text"
  ;;

Technical Analysis

The type command accepts arbitrary text for injection into the active GUI window and subsequently prints the entire value to standard output. GUI automation may be used to enter passwords, API tokens, personal information, private messages, or other confidential form data.

Although the shell variable is correctly quoted and does not create command injection in this code segment, the status message duplicates the sensitive value into a less restricted output channel. Standard output may be captured by Agent transcripts, gateway logs, terminal recorders, CI systems, or process supervisors.

Attack Path

1. A user asks the Agent to enter a password, access token, or other confidential value into a GUI application.
2. The Agent invokes gui-helper.sh type with that value as an argument.
3. xdotool types the value into the active window.
4. The script executes echo "Typed: $text" and discloses the complete value through standard output.
5. Any surrounding logging or transcript system records the disclosed value.
6. An operator or process with access to those records can recover the secret.

Impact Assessment

This issue does not directly grant elevated operating-system privileges. Its scope is confidentiality: any text passed to the type operation can be exposed to entities that can access command output or Agent logs. If the disclosed value is a privileged credential or session token, subsequent misuse could provide the permissions associated with that credential, potentially including access to external accounts or protected applications.

Remediation

View remediation

Remediation Suggestions

• Do not include user-supplied text in status output. Replace the vulnerable message with a constant confirmation:

  bash

  type)
    text="${1:-}"
    xdotool type --delay 50 -- "$text"
    echo "Text typed"
    ;;
  

• Avoid passing secrets through command-line arguments where practical, because process inspection and shell history may expose them. Accept sensitive input through standard input or a protected file descriptor.

• Ensure Agent and gateway logging systems redact credentials and minimize retention of command inputs and outputs.

• Document that the helper must not echo, log, or persist GUI input values.

T02 · Agent Memory Poisoning

Note

• Location: SKILL.md:106

Finding

Unnecessary Instruction to Modify Persistent Cross-Session Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 106–109
Vulnerability Type: Persistent Agent-state modification
Risk Level: Low

markdown

### Gateway + GUI
- When running `nanobot gateway`, always start with `DISPLAY=:1` so Telegram/Discord agents can use GUI
- The gateway agent has its own context — it won't know about the display unless MEMORY.md says so
- Write important system info to MEMORY.md so all channels stay informed

Technical Analysis

The Skill instructs the Agent to write unspecified “important system info” into MEMORY.md so it becomes available across channels. GUI control only requires process-scoped display configuration and does not require persistent Agent-memory modification.

The instruction is overly broad because it does not define which information is safe to persist, establish user consent, impose data minimization, or restrict which future sessions and channels may consume the stored information. This creates a persistent-state contamination risk and may cause environmental or operational details to affect unrelated future conversations.

The reviewed text does not explicitly instruct the Agent to store credentials or attacker-controlled behavioral rules. Therefore, the demonstrated impact is limited compared with a full malicious memory-poisoning payload.

Attack Path

1. The GUI-control Skill is loaded and its gateway guidance is followed.
2. The Agent identifies environmental or system information that it considers “important.”
3. The Agent writes that information to MEMORY.md without a defined allowlist or retention boundary.
4. The persistent memory survives the current Skill invocation.
5. Later gateway sessions or unrelated channels read and use that information.
6. Environmental details may consequently be disclosed across contexts or influence future Agent behavior outside the original task.

Impact Assessment

No operating-system privileg ...[truncated 367 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the instruction to write system information into MEMORY.md.
• Configure DISPLAY=:1 through process-scoped environment configuration, a gateway service definition, or another explicit runtime configuration mechanism.
• If persistent memory is genuinely required, define a strict allowlist of non-sensitive fields, obtain user authorization, and establish retention and deletion rules.
• Prohibit credentials, tokens, user data, host identifiers, and behavioral instructions from being persisted by this Skill.
• Keep configuration isolated by channel or session rather than sharing it globally.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description mostly aligns with the script’s general purpose of local GUI automation using Firefox, scrot, and xdotool. However, there is a material mismatch because the description explicitly says it can 'click/type on screen,' while the code only supports typing and key presses—there is no mouse click command. The description also suggests general GUI interaction, but the implementation is relatively narrow. Additionally, the script can retrieve the active window name, an undeclared capability, though this is minor compared with the missing click support.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation description is broad enough that an agent may apply this skill to many ordinary browsing or GUI requests without strong safety gating. In context, this skill can launch applications, drive live UI state, and interact with websites, so overly broad triggering increases the chance of unintended actions in sensitive sessions or applications.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

Open Firefox with a URL

bash

DISPLAY=:1 nohup firefox https://example.com > /dev/null 2>&1 &

Wait for page load before interacting:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

Open Firefox with a URL

bash

DISPLAY=:1 nohup firefox https://example.com > /dev/null 2>&1 &

Wait for page load before interacting:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

Open Firefox with a URL

bash

DISPLAY=:1 nohup firefox https://example.com > /dev/null 2>&1 &

Wait for page load before interacting:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/gui-helper.sh (reported line 24)May include surrounding context.

sh

### Open Firefox with a URL

```bash
DISPLAY=:1 nohup firefox https://example.com > /dev/null 2>&1 &
```

Wait for page load before interacting:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guidance encourages typing, key presses, and browser interaction on a live GUI without warning that these actions can affect whichever application currently has focus or can submit forms and trigger side effects. In a real desktop session, misfocused keystrokes or automated navigation could send messages, alter settings, approve prompts, or submit sensitive data unintentionally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to capture and send screenshots to the user but provides no safeguards against collecting secrets visible on screen, such as passwords, tokens, private messages, or unrelated application content. Because this operates on a live desktop, screenshots may expose far more data than the intended target webpage or application state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.