Linux System Controller

• Outcome: Review
• Latest audit: May 28, 2026 · 8:05 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Linux system controller, but it bundles very broad local-control powers with weak built-in boundaries.

Install only if you intentionally want an agent to control your Linux desktop, processes, network settings, serial devices, screenshots/OCR, and smart-home/API endpoints. Review exact commands and URLs before execution, avoid using it around secrets on screen, use least-privilege short-lived tokens where possible, and run it only in environments where broad local control is acceptable.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (29)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
        print("Installing pyautogui...", file=sys.stderr)
        import subprocess
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "pyautogui", "-q"],
            stdout=subprocess.DEVNULL
        )

• Confidence: 97% confidence
• Finding: The script automatically installs pyautogui at runtime via pip, which gives a GUI-control skill unnecessary package-management and external code download capability. Even though shell injection is not present because arguments are passed as a list, this still changes the host environment and executes newly downloaded code without explicit approval, increasing supply-chain and policy-bypass risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
        print("Installing pillow...", file=sys.stderr)
        import subprocess
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "pillow", "-q"],
            stdout=subprocess.DEVNULL
        )

• Confidence: 97% confidence
• Finding: The script silently installs Pillow when missing, causing the skill to modify the environment and fetch third-party code at execution time. That behavior exceeds the stated GUI-control purpose and introduces avoidable supply-chain exposure and unauthorized system changes.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
        print("Installing pytesseract...", file=sys.stderr)
        import subprocess
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "pytesseract", "-q"],
            stdout=subprocess.DEVNULL
        )

• Confidence: 97% confidence
• Finding: The runtime pip install of pytesseract adds package-installation capability to an OCR helper path and executes code obtained from an external repository without prior approval. This is risky in agent environments because it can bypass deployment controls and alter the system unexpectedly.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_command(cmd, timeout=30):
    """Execute shell command with proper encoding."""
    try:
        result = subprocess.run(
            cmd,
            shell=True,
            capture_output=True,

• Confidence: 97% confidence
• Finding: The helper executes arbitrary shell strings with `subprocess.run(..., shell=True)`, and several callers build those strings with user-controlled values such as the network adapter name. This enables command injection if an attacker supplies shell metacharacters, allowing arbitrary OS command execution with the privileges of the agent process.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return requests
    except ImportError:
        print("Installing requests...")
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "requests", "-q"],
            stdout=subprocess.DEVNULL
        )

• Confidence: 95% confidence
• Finding: The script automatically invokes pip via subprocess to modify the Python environment at runtime. This is dangerous because it performs code-fetching and installation from external package sources without explicit user approval, expanding the skill from device control into software installation and creating supply-chain and environment-tampering risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_command(cmd, timeout=30):
    """Execute shell command with proper encoding."""
    try:
        result = subprocess.run(
            cmd,
            shell=True,
            capture_output=True,

• Confidence: 99% confidence
• Finding: The helper executes arbitrary shell strings with shell=True, and multiple callers build those strings using user-controlled values such as process names and PIDs. In this system-control skill, that creates direct command-injection risk and turns normal process-management actions into arbitrary OS command execution.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""Start a process."""
    try:
        # Use nohup to run in background
        process = subprocess.Popen(
            command,
            shell=True,
            stdout=subprocess.DEVNULL,

• Confidence: 99% confidence
• Finding: start_process launches a user-supplied command string with shell=True, which permits arbitrary shell metacharacters, chaining, redirection, and command substitution. Because this skill is explicitly intended to control the local Linux system, exploitation would give the agent a straightforward path to execute arbitrary programs or destructive commands.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return True
    except ImportError:
        print("Installing pyserial...")
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "pyserial", "-q"],
            stdout=subprocess.DEVNULL
        )

• Confidence: 95% confidence
• Finding: The script executes a package installation subprocess at runtime whenever pyserial is missing. Even though it does not invoke a shell and the command is fixed, this still expands the skill's capabilities from serial I/O into package management and code retrieval/execution from the Python package ecosystem, which is risky in an agent context.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_command(cmd, timeout=30):
    """Execute shell command with proper encoding handling."""
    try:
        result = subprocess.run(
            cmd,
            shell=True,
            capture_output=True,

• Confidence: 99% confidence
• Finding: The helper executes arbitrary command strings with subprocess.run(..., shell=True), and multiple callers build those strings with f-strings from CLI-controlled values such as window_id and text. This creates a direct shell-injection path where crafted input can break out of the intended wmctrl/xdotool invocation and execute arbitrary OS commands under the agent's privileges.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill exposes shell and network-capable operations but does not declare permissions or equivalent trust boundaries, making it harder for the platform and users to understand the real authority of the skill. In this skill, those capabilities are especially sensitive because they can drive system control, call arbitrary HTTP endpoints, and automate the desktop, increasing the chance of abuse or unsafe invocation.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: This finding is valid because the skill is supposed to control the GUI, yet it also performs package installation, expanding its authority beyond its declared scope. In an agent setting, hidden environment-changing behavior is especially dangerous because it enables network retrieval and execution of additional code not reviewed as part of the skill.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The Pillow auto-installation is a true scope-expansion issue: screenshot capability does not require the skill itself to manage packages at runtime. This broadens what the skill can do on the host and weakens change-control and review boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The OCR path similarly extends the skill into package management by installing pytesseract on demand. In context, this is more dangerous because the skill already has powerful desktop-observation and input-control capabilities, so adding code-download behavior compounds risk.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: An IoT control utility should not silently install packages as a side effect of normal use. This behavior is unrelated to the stated purpose and allows unreviewed code to be introduced into the host environment, which is especially risky in an agent skill context where users may not expect system modification.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The generic HTTP mode is not constrained to smart-home or local-device APIs and can send requests to arbitrary URLs. In an agent environment, this effectively provides a general-purpose network client that can be abused for SSRF-style access, internal service interaction, or unauthorized outbound data transmission beyond the declared skill scope.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: Runtime installation of pyserial gives this helper unintended package-management capability and causes execution of externally fetched code during normal operation. In a system-control skill, that broadens the attack surface and violates least privilege because a serial helper should not modify the Python environment or reach out to install software.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation conditions are extremely broad and cover many common user intents, which can cause the skill to be invoked in situations where high-risk system actions are not expected. Because this skill can manage processes, power, networking, GUI input, screenshots, and HTTP requests, overbroad routing materially increases the risk of unintended destructive or privacy-invasive actions.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The unknown-device guidance encourages progressively broader fallback behavior, including screenshots, OCR, mouse/keyboard automation, generic HTTP interaction, USB inspection, and serial probing. This can expand execution beyond a clearly bounded task and lead to opportunistic access to sensitive on-screen data, local devices, or networked systems without a sufficiently constrained scope.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill documents screenshot, OCR, and generic HTTP capabilities without strong user-facing privacy and data-handling warnings, even though these features can capture sensitive screen content and send data to external endpoints. In a system-control skill with desktop automation, these features materially raise the risk of credential exposure, sensitive document capture, and exfiltration.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The reference explicitly documents destructive capabilities such as closing windows, killing processes, sleeping, hibernating, shutdown, restart, and disabling network adapters, but provides no cautionary language, confirmation requirements, or usage constraints. In a skill designed for broad system control and automation, this omission increases the risk that an agent or user will invoke disruptive actions accidentally or without appreciating their consequences.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The examples show direct use of Home Assistant tokens and arbitrary HTTP requests for device control without any guidance on secret handling, redaction, transport security, or target validation. Because this skill supports remote control of IoT devices and generic HTTP operations, careless reuse of these examples could expose credentials, enable unauthorized device actions, or facilitate SSRF-like access to internal network services.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script performs pip installation automatically and without explicit confirmation, so an operator invoking a simple GUI action may unknowingly trigger environment modification and code download. Lack of informed consent and disclosure is a genuine safety issue, particularly for a system-control skill running with the user's desktop permissions.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Auto-installing Pillow without prior notice is a true safety problem because it changes the host state and pulls external code during normal operation. Users and orchestrators may reasonably expect a screenshot tool to fail if prerequisites are absent, not mutate the environment silently.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The pytesseract installation path likewise lacks clear disclosure or confirmation for an environment-changing action. In a security-sensitive agent ecosystem, silent dependency installation can violate least surprise, policy requirements, and auditing expectations.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill exposes suspend, hibernate, shutdown, and restart operations directly, with no confirmation, authorization, or safety interlock. In an agent context that may execute user-requested actions automatically, this can be abused for denial of service, interrupt active sessions, or cause data loss from unsaved work.

Static analysis

No suspicious patterns detected.