claw-windows-automator

• Outcome: Review
• Latest audit: Jul 9, 2026 · 2:02 PM UTC
• Version: 1.0.4

Overview

This Windows automation skill matches much of its stated purpose, but it needs review because it auto-modifies Python environments and includes an undocumented WeChat automation task.

Install only if you intentionally want a powerful Windows desktop automation skill that can run commands, open browsers, download code, and change Python packages. Review the hidden WeChat task, unvalidated URL handling, and automatic pip/setuptools changes first; prefer using it in an isolated environment with explicit confirmation before command execution or downloads.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (32)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""专门为老项目（使用 pkg_resources 的 setup.py）修复 setuptools 版本"""
    try:
        # 先强制修复损坏的 packaging 包（关键！解决无RECORD文件报错）
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])

• Confidence: 93% confidence
• Finding: This subprocess call performs a pip install that mutates the Python environment during module operation, and it is executed as part of a helper intended for package management. While the arguments are static here, the dangerous aspect is the undisclosed environment modification and dependency tampering, especially because the module also invokes this repair path automatically on import.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])
        # 再安装兼容的 setuptools + wheel
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--force-reinstall", "setuptools<=81.2.0", "wheel"
        ])

• Confidence: 94% confidence
• Finding: This subprocess call force-reinstalls setuptools and wheel, changing core packaging tooling for the interpreter. Modifying build/install infrastructure can destabilize the environment, affect unrelated projects, and create a supply-chain risk if triggered without explicit consent or isolation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.extend(["-i", "https://pypi.tuna.tsinghua.edu.cn/simple"])

    try:
        subprocess.check_call(cmd)
        logger.info(f"✅ {spec} 安装/升级完成！")
        
    except subprocess.CalledProcessError as e:

• Confidence: 98% confidence
• Finding: This call executes pip install using a command assembled from the spec parameter, which supports arbitrary package names, git URLs, and local zip/wheel files. In the context of a desktop automation skill, this enables broad code installation and execution from external sources, creating a serious supply-chain and arbitrary code execution risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.warning(f"🔧 正在安装 {install_str} ...")

    try:
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            install_str,
            "-i", "https://pypi.tuna.tsinghua.edu.cn/simple",

• Confidence: 97% confidence
• Finding: This helper installs arbitrary packages and version constraints from runtime parameters, causing environment mutation and potential execution of untrusted package setup/build code. Even though it uses pip argument lists instead of a shell, it still permits unsafe dependency installation outside the skill's declared Windows automation scope.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

sys.executable, "-m", "pip", "install",
                        "--upgrade", fallback_zip, "--verbose"
                    ]
                    subprocess.check_call(cmd_fallback)
                    logger.info(f"✅ 使用本地包 {fallback_zip} 安装成功！")
                    return
                except subprocess.CalledProcessError as e2:

• Confidence: 96% confidence
• Finding: This fallback path installs a local zip package specified at runtime, which can contain arbitrary Python code executed during installation. Accepting unverified local archives as an automatic recovery mechanism significantly increases the risk of malicious package execution and persistence.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises and invokes shell execution, network access, and environment interaction, yet declares no permissions. This creates a dangerous transparency gap: an agent or user may authorize the skill under false assumptions while it can execute commands and reach external resources.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: A description-behavior mismatch is security-relevant because operators may trust the documented scope while the implementation performs additional actions such as WeChat automation, virtual environment creation, and package installation. Hidden or undocumented behaviors expand the attack surface and can lead to unexpected external communication or code execution.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The module performs `ensure_package.pip("pyautogui")` at runtime, which introduces package installation and likely network/package-management behavior into a base automation component. This expands the trust boundary beyond local input automation: a skill invocation can trigger dependency retrieval or installation side effects, creating supply-chain and unexpected code-execution risk if package sources are compromised or if runtime installs are not tightly controlled.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The module's declared purpose and capability extend into broad Python package installation and environment mutation, which is materially different from the skill's stated Windows desktop automation role. This scope expansion increases the attack surface by enabling software installation behavior that users may not expect from the manifest.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The module executes pip-based repairs immediately at import time, silently modifying packaging, setuptools, and wheel before any explicit user action. Import-time side effects that change the host environment are especially dangerous because they bypass normal review points and can break systems or introduce supply-chain exposure unexpectedly.

Intent-Code Divergence

Medium

• Confidence: 85% confidence
• Finding: The documentation presents the function as lightweight, but the implementation performs real package installation and upgrades that can alter the runtime environment. Misrepresenting the strength of side effects undermines informed consent and can lead operators to invoke risky behavior unintentionally.

Description-Behavior Mismatch

High

• Confidence: 87% confidence
• Finding: The file performs virtual-environment bootstrapping and dependency installation that materially exceeds the manifest's stated Windows automation scope. In an agent skill context, undeclared environment mutation and package deployment broaden the trust boundary and can surprise users or reviewers, increasing the chance of unintended code execution and supply-chain exposure.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The documented capability to install PyTorch, audio-separator, librosa, and related ML/audio packages is not justified by a Windows CMD/GitHub/GUI automation skill. Unnecessary high-privilege dependency installation enlarges the attack surface, introduces heavy third-party code, and creates avoidable supply-chain risk.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The module automatically locates and restarts an inferred main script inside a new virtual environment, including fallback path guessing. In an agent setting, that behavior expands execution beyond the narrow automation actions users expect and can cause unintended script execution if the working directory or project layout is manipulated.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The code accepts any caller-supplied URL, injects it directly into a `cmd.exe /c start` command, and then drives the browser to that destination without verifying it is a GitHub repository URL. In this skill context, that is especially dangerous because the feature is explicitly marketed as a safe GitHub downloader, yet it can be repurposed to open arbitrary sites or abuse shell metacharacters in the Run command path, leading to unintended command execution or delivery of untrusted content.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The operation registry exposes `webchat_download_audio`, which is unrelated to the declared Windows automation scope and is not described in the manifest. Hidden or out-of-scope capabilities are dangerous because they expand the skill’s effective permissions and can be invoked unexpectedly, undermining user trust and security review boundaries.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The registered description for `webchat_download_audio` falsely labels the task as opening a directory and executing a bat file, while it actually invokes an audio-download capability. Mislabeling a callable operation can conceal unexpected behavior from users and reviewers, making social engineering or unauthorized task execution easier.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The file implements WeChat-specific GUI automation, including window discovery, contact search, and interaction, which is outside the skill manifest's stated scope of generic Windows automation, CMD execution, and GitHub downloads. This scope mismatch is dangerous because it introduces undeclared application-control capability that could be repurposed to interact with private chats or trigger unintended actions in a sensitive messaging app.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code can focus the WeChat window and navigate to a specified contact, but that capability is not justified by the documented purpose of the skill. In context, undeclared contact-navigation in a messaging client increases risk because it can facilitate access to private conversations or serve as a stepping stone for message/file manipulation without clear user awareness.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README explicitly promotes opening CMD in a chosen directory and executing user-supplied commands or scripts, but it does not include meaningful safety constraints, validation guidance, or warnings about destructive system changes. In the context of an LLM-triggerable Windows automation skill, this increases the chance that unsafe prompts, prompt injection, or operator mistakes will result in arbitrary command execution on the host.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Overly broad trigger phrases can cause the skill to activate on ordinary conversation and then perform powerful actions like command execution or downloading code. In this context, accidental invocation materially increases the chance of unintended system changes.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The instruction to include as many trigger phrases as possible promotes collision with unrelated requests and increases the probability that a high-risk automation skill runs unintentionally. Because this skill can execute arbitrary commands, trigger ambiguity is not just usability debt but a security issue.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: Several example triggers are generic enough to match benign user requests, yet the skill's behavior includes shell execution and automation. Generic activation language lowers the barrier for accidental or manipulated invocation of sensitive capabilities.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly supports executing arbitrary commands and bat scripts but does not prominently warn about risks such as data loss, malware execution, persistence, or system compromise. In a Windows automation skill, omission of these warnings is especially dangerous because users may treat it as routine automation rather than unrestricted code execution.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: Automatically opening a browser and downloading from GitHub creates network and privacy implications that are not disclosed to the user. Even if GitHub is a common destination, silent external access can leak repository interest, IP metadata, and lead users to run unreviewed downloaded content.

Static analysis

No suspicious patterns detected.