Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed Linux system-control toolkit, but verified command-injection flaws, runtime package installation, and broad local/network control make it require Review before installation.
Review and harden this skill before installing on a real desktop or server. Use it only in a contained environment, avoid running it as root, do not pass real long-lived tokens on the command line, restrict HTTP destinations, and fix shell=True command construction and runtime pip installation first.
scripts/process_manager.py:40Shell Command Injection Through Process Name Arguments
scripts/hardware_controller.py:185Shell Command Injection Through Network Adapter Names
scripts/window_manager.py:82Shell Command Injection Through Window Identifier Arguments
scripts/iot_controller.py:29Automatic Installation of Unpinned Runtime Dependencies
scripts/iot_controller.py:249Long-Lived Access Tokens Passed in Process Arguments and Sent to Unrestricted URLs
scripts/gui_controller.py:146Sensitive Screenshots Persist Without Explicit Access or Retention Controls
This documented skill includes generic HTTP/REST access to arbitrary endpoints under the broad banner of system control, which meaningfully expands capability beyond a narrowly described local-control package. In practice, that can be used to exfiltrate data, contact attacker-controlled services, or operate as an unrestricted network pivot, and the broad description may prevent users and reviewers from recognizing that risk.
This documented skill includes generic HTTP/REST access to arbitrary endpoints under the broad banner of system control, which meaningfully expands capability beyond a narrowly described local-control package. In practice, that can be used to exfiltrate data, contact attacker-controlled services, or operate as an unrestricted network pivot, and the broad description may prevent users and reviewers from recognizing that risk.
This documented skill includes generic HTTP/REST access to arbitrary endpoints under the broad banner of system control, which meaningfully expands capability beyond a narrowly described local-control package. In practice, that can be used to exfiltrate data, contact attacker-controlled services, or operate as an unrestricted network pivot, and the broad description may prevent users and reviewers from recognizing that risk.
The activation description is extremely broad and covers many common requests involving desktop control, networking, screenshots, OCR, smart-home control, and device communication. In an agent-routing context, this increases the chance the skill is invoked in situations involving sensitive data or high-impact actions, expanding attack surface and enabling overreach beyond user intent.
This is a concrete tool-parameter-abuse issue because the code exposes privileged system-control operations and passes constructed command strings to a shell. In the skill context, parameters like --adapter are likely agent/user influenced, so an attacker could inject shell metacharacters and execute arbitrary OS commands, potentially altering network state, power state, or broader system behavior.
def run_command(cmd, timeout=30):
"""Execute shell command with proper encoding."""
try:
result = subprocess.run(
cmd,
shell=True,
capture_output=True,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
ha_tog.add_argument("--entity-id", type=str, required=True)
p_ha.add_argument("--url", type=str, required=True, help="Home Assistant base URL")
p_ha.add_argument("--token", type=str, required=True, help="Long-lived access token")
# Generic HTTP
p_http = sub.add_parser("http", help="Generic HTTP/REST control")
This tool exposes a shell-backed command runner that is fed by higher-level functions using untrusted parameters, enabling tool parameter abuse. In this skill context, users ask the agent to control Linux processes, so an attacker can supply crafted names or values to break out of intended process management and execute arbitrary commands.
def run_command(cmd, timeout=30):
"""Execute shell command with proper encoding."""
try:
result = subprocess.run(
cmd,
shell=True,
capture_output=True,
This duplicate finding points to the same unsafe Popen(..., shell=True) call, which allows attacker-controlled command text to be interpreted by the shell. Because execution is detached, malicious commands can continue running after the invoking session ends, compounding the impact.
"""Start a process."""
try:
# Use nohup to run in background
process = subprocess.Popen(
command,
shell=True,
stdout=subprocess.DEVNULL,
This duplicate finding points to the same unsafe Popen(..., shell=True) call, which allows attacker-controlled command text to be interpreted by the shell. Because execution is detached, malicious commands can continue running after the invoking session ends, compounding the impact.
"""Start a process."""
try:
# Use nohup to run in background
process = subprocess.Popen(
command,
shell=True,
stdout=subprocess.DEVNULL,
The tool takes parameters that flow into shell-command construction without robust validation, creating a direct parameter-abuse channel. Because this skill is a privileged system-controller for desktop automation, successful abuse can escalate from UI manipulation to arbitrary command execution and full compromise of the user's session.
def run_command(cmd, timeout=30):
"""Execute shell command with proper encoding handling."""
try:
result = subprocess.run(
cmd,
shell=True,
capture_output=True,
The skill advertises and orchestrates powerful shell and network-capable operations but does not declare an explicit tool scope such as allowed-tools or permissions. For a system-control skill, this weakens policy boundaries and can let the agent invoke high-risk capabilities more broadly than reviewers or runtime policy expect.
The skill supports Home Assistant tokens and generic HTTP operations to arbitrary endpoints but does not clearly warn that credentials, device state, and potentially sensitive environment data may be transmitted externally. In this context, omission is especially risky because the same skill already has system-control semantics, making users more likely to trust it with powerful secrets and commands.
Screenshot, OCR, and visual-recognition functions can capture passwords, personal messages, tokens, financial data, and other sensitive on-screen content, yet the markdown provides no clear privacy warning about that collection risk. Because this skill is specifically designed to inspect the screen, the context makes the omission more dangerous than in a non-visual skill.
The reference explicitly documents sleep, hibernate, shutdown, and restart operations without any caution about immediate service interruption, unsaved data loss, or the need for explicit user confirmation. In a system-control skill, these are high-risk actions because an agent could invoke them directly and disrupt the active session or terminate critical work.
The documented network enable/disable commands can sever the host's connectivity, including the agent's own control channel, yet the reference provides no warning about operational impact. In an automation context, this increases the chance of accidental denial of service or loss of remote access.
The command reference includes bearer tokens in CLI examples and supports outbound HTTP/Home Assistant calls without warning about secret exposure, logging risks, or exfiltration of data to remote services. In a system-controller skill, this is especially dangerous because it combines sensitive credentials with network-capable actions that can affect external devices or transmit data off-host.
Mouse and keyboard automation can trigger arbitrary actions in the active desktop session, including dismissing prompts, sending messages, launching programs, or interacting with privileged dialogs. Without warnings or safety guidance, the skill makes unintended or unsafe UI-driven actions more likely, especially when window focus changes or coordinates are stale.
Screenshot, OCR, pixel sampling, and image-based interaction can capture secrets visible on screen, including messages, credentials, tokens, and personal data. Because this skill is designed for desktop control, these capabilities materially increase privacy and data-exfiltration risk if used without prominent warnings or consent boundaries.
Self-installing pyautogui extends the skill beyond desktop control into host package management, which is a separate privileged capability. In the context of a system-controller skill, this is more dangerous because the tool already enables UI automation that could be chained with newly installed software for broader host manipulation.
Automatic pip installation occurs without any confirmation, warning, or explicit opt-in, so a caller can cause software changes simply by invoking the skill. Unannounced package installation is unsafe because it can surprise operators, violate change-control expectations, and introduce unreviewed code into the environment.
The script invokes pip at runtime to install pyautogui automatically, which is an unexpected capability expansion and local environment modification. Even though the command is not shell-injected, it still executes an external package-management operation without consent, creating supply-chain and integrity risk if package sources or environment configuration are compromised.
except ImportError:
print("Installing pyautogui...", file=sys.stderr)
import subprocess
subprocess.check_call(
[sys.executable, "-m", "pip", "install", "pyautogui", "-q"],
stdout=subprocess.DEVNULL
)
Installing pillow at runtime modifies the local environment and adds package-management behavior outside the stated scope of screenshot handling. This violates least privilege and creates an unnecessary avenue for unintended changes or abuse.
The script silently installs pillow when missing, without any user-facing disclosure that the environment will be modified. This undermines transparency and safe operation practices, especially for a desktop-control skill that may be used on sensitive hosts.
The script automatically installs pillow during execution, causing silent software installation unrelated to the immediate GUI action requested by a caller. This increases attack surface and can let a skill alter the host environment in ways users may not expect or authorize.
except ImportError:
print("Installing pillow...", file=sys.stderr)
import subprocess
subprocess.check_call(
[sys.executable, "-m", "pip", "install", "pillow", "-q"],
stdout=subprocess.DEVNULL
)
The OCR dependency path downloads or installs pytesseract during execution, which is environment-changing behavior not inherent to OCR itself. Because OCR can expose secrets visible on screen, combining it with silent package installation raises the overall risk profile of the skill.
No suspicious patterns detected.