Back to skill

Security audit

Desktop Control 1.0.0

Security checks for vulnerabilities and agentic risk

Overview

This desktop automation skill fits its stated purpose, but it needs review because it can control the live desktop, capture screen and clipboard data, and its approval and safety controls are incomplete.

Install only if you are comfortable giving the skill control of your active desktop. Use it in a non-admin session, keep failsafe enabled, avoid sensitive screens and clipboard contents, do not use it for passwords or irreversible submissions without manual review, and prefer pinned dependencies in an isolated virtual environment.

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
__init__.py:123
Finding

Approval Mode Does Not Protect All Sensitive or State-Changing Operations

Content
View full analysis
None: if x is not None and y is not None: pyautogui.moveTo(x, y) if direction == 'vertical': pyautogui.scroll(clicks) else: pyautogui.hscroll(clicks) logger.debug(f"Scrolled {direction} {clicks} clicks") ``` ```python def key_down(self, key: str) -> None: """Press and hold a key without releasing.""" pyautogui.keyDown(key) logger.debug(f"Key down: '{key}'") def key_up(self, key: str) -> None: """Release a held key.""" pyautogui.keyUp(key) logger.debug(f"Key up: '{key}'") ``` ```python def screenshot(self, region: Optional[Tuple[int, int, int, int]] = None, filename: Optional[str] = None): img = pyautogui.screenshot(region=region) if filename: img.save(filename) logger.info(f"Screenshot saved to: {filename}") else: logger.debug(f"Screenshot captured (region={region})") return img ``` ```python def copy_to_clipboard(self, text: str) -> None: try: import pyperclip pyperclip.copy(text) logger.info(f"Copied to clipboard: '{text[:50]}...'") except ImportError: logger.error("pyperclip not installed. Run: pip install pyperclip") except Exception as e: logger.error(f"Error copying to clipboard: {e}") def get_from_clipboard(self) -> Optional[str]: try: import pyperclip text = pyperclip.paste() logger.debug(f"Got from clipboard: '{text[:50]}...'") return text except ImportError: logger.error("pyperclip not installed. Run: pip install pyperclip") return None except Exception as e: logger.error ...[truncated 2203 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
__init__.py:168
Finding

Typed and Clipboard Content Is Written to Application Logs

Content
View full analysis
50 else ''}' " f"(interval={interval:.3f}s)" ) ``` ```python def copy_to_clipboard(self, text: str) -> None: try: import pyperclip pyperclip.copy(text) logger.info(f"Copied to clipboard: '{text[:50]}...'") except ImportError: logger.error("pyperclip not installed. Run: pip install pyperclip") except Exception as e: logger.error(f"Error copying to clipboard: {e}") ``` ### Technical Analysis The implementation records up to the first 50 characters of typed and copied text. The log level is `INFO`, and the module configures global logging with: ```python logging.basicConfig(level=logging.INFO) ``` Desktop automation commonly handles passwords, authentication tokens, personal information, email contents, form values, and confidential business data. Logging the first 50 characters is not effective redaction because many secrets are shorter than that limit. The exposure may persist in terminal history, redirected standard output, service logs, CI logs, monitoring platforms, or any log collector attached to the hosting process. ### Attack Path 1. A user calls `type_text()` to enter a password, token, or confidential form value, or calls `copy_to_clipboard()` with sensitive text. 2. The operation succeeds. 3. The method includes the first 50 characters of the value in an `INFO` log message. 4. Logs are displayed, redirected, retained, or forwarded by the hosting environment. 5. A local user, administrator, support operator, or logging-system account with access to those logs retrieves the sensitive value. # ...[truncated 482 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:51
Finding

Dependency Installation Instructions Use Unpinned Packages Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:595
Finding

Documentation Encourages Running the Entire Automation Process with Administrator Privileges

Content
View full analysis
Remediation
View remediation
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (23)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description frames the skill as desktop automation, but the documented capabilities materially expand into window enumeration, clipboard read/write, screenshots, and interactive prompts. Those additional data-access and control surfaces increase the privilege and sensitivity of the skill, and under-describing them can mislead reviewers or users about surveillance and manipulation risks.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The class advertises a require_approval safety control, but multiple action methods bypass it, including scrolling, key hold/release, screenshots, pixel reads, image search, window operations, clipboard operations, and dialogs. This creates a misleading security boundary: users or integrators may believe all actions require confirmation when in fact sensitive operations can still execute silently.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The agent performs screen capture and stores the collected images without any explicit disclosure that on-screen sensitive data may be collected. Because desktop screens often expose unrelated confidential information, this omission creates a significant privacy and compliance risk even if the feature was intended for debugging or verification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guide encourages broad natural-language task execution such as opening apps, drawing, typing, and autonomous control without defining clear boundaries, confirmations, or prohibited actions. In a desktop automation skill, ambiguous prompts can cause unintended actions in the wrong application or context, increasing the chance of unsafe clicks, keystrokes, or data disclosure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The 'What Can It Do?' section presents autonomous game playing, adaptive screen-based behavior, and broad autonomous control as available current functionality. Later in the same document, those same capabilities are described as 'In Progress,' 'Planned,' 'Experimental,' or future enhancements, which is a direct contradiction in the skill's own documentation about actual implemented scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation describes autonomous screenshot capture and saving as part of normal operation without warning that screenshots may contain credentials, personal messages, regulated data, or other sensitive screen content. In a desktop-control agent, automatic image capture creates a real risk of inadvertent collection, retention, and exposure of sensitive information.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The architecture and component descriptions state that the agent observes the screen, understands it via screenshots/OCR/object detection, and verifies results as if these are present components. However, the future enhancements section later lists computer vision, OCR, object detection, and UI recognition as planned features, creating a clear contradiction about what the code currently does.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The guide introduces autonomous file operations like copying files without warning about overwriting, moving, deleting, or acting on the wrong path. In a desktop automation context, file actions can quickly affect user data integrity if the agent misidentifies targets or executes in the wrong window or folder.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The examples promote automated form filling and data entry using resume, PDF, and spreadsheet data without warning about privacy, consent, mis-entry, or submission risks. Because this skill operates on live desktops, it could expose personal data to unintended fields, websites, or applications and trigger irreversible submissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide exposes a no-failsafe mode and frames it as a performance option without warning that disabling failsafes can remove the user's ability to quickly stop uncontrolled mouse and keyboard automation. In a desktop agent, this significantly increases the risk of runaway input, destructive actions, and interference with other applications or security dialogs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This quick reference immediately provides powerful desktop automation primitives that can click, type, switch windows, launch apps, manipulate files, and disable safety controls before giving any prominent risk warning. In an agent-skill context, that omission is dangerous because users or downstream agents may copy examples that alter system state, submit forms, overwrite data, or interact with sensitive applications without appreciating the consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The screenshot, screen-search, and clipboard examples normalize collection of on-screen content and clipboard data without warning that these may contain credentials, personal data, tokens, messages, or confidential documents. In a desktop-control skill, this is especially sensitive because screen capture and clipboard access are common exfiltration paths and the examples present them as routine operations without consent, minimization, or storage safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Documenting screenshot and clipboard features without an explicit warning obscures the risk of collecting secrets such as passwords, tokens, messages, financial data, or proprietary content visible on screen or stored in the clipboard. In a desktop-control skill, these capabilities are especially sensitive because they can expose user data far beyond the intended task context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The examples and API describe high-impact mouse and keyboard automation that can submit forms, trigger shortcuts, drag files, and alter application state, but they do not clearly warn about accidental destructive actions. In a desktop automation context, small targeting or focus errors can cause unintended file moves, data overwrites, message sending, or execution of dangerous system shortcuts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Screenshot capture can expose on-screen secrets such as messages, credentials, documents, or security prompts, and saving to a file creates a durable artifact that can later be exfiltrated. Because this occurs without approval or disclosure, it enables covert observation beyond normal input automation expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description promises mouse, keyboard, and screen control, but the code also enumerates and activates windows and accesses the system clipboard. These extra capabilities expand the attack surface beyond the declared purpose and enable collection or manipulation of unrelated user data, which is especially risky in an automation skill that can already drive the desktop.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Clipboard read/write access is sensitive because the clipboard commonly contains passwords, tokens, personal data, or copied documents. Adding this capability to a desktop-control skill without clear justification or user disclosure enables silent data access and tampering outside the user's expected scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

Reading clipboard contents without disclosure gives the skill access to potentially sensitive transient data, including passwords, API keys, financial data, or private text copied from other applications. In the context of a desktop automation tool, this is more dangerous because it can combine clipboard access with window focus and input simulation to harvest or misuse user data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The agent is designed to autonomously control the live desktop, including launching apps and sending input, yet it provides no explicit warning or confirmation that these actions may interfere with open applications or trigger unintended system changes. In this context, absence of gating is dangerous because normal language tasks can translate directly into impactful host actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code captures screenshots before and after every step and stores them in the result object, creating a systematic screen-surveillance and data collection channel. Screens may contain passwords, emails, documents, tokens, chats, or other sensitive content unrelated to the requested task, so retaining them materially expands privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The screenshot step writes image files to disk without explicit disclosure or user control over destination, creating persistent artifacts that may expose sensitive on-screen information to other users, backups, or later compromise. Persisting screenshots is more dangerous than transient capture because it extends the exposure window and complicates deletion and auditing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The agent launches applications by opening the OS Run dialog and typing a command derived from the task/app name, which gives it a broad program-execution capability beyond narrowly scoped mouse/keyboard automation. In a desktop agent, this meaningfully increases risk because a prompt or upstream component could cause execution of unintended local tools, scripts, or system utilities with effects on the live host.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This section shows executable-style examples for screen analysis and LLM-backed reasoning, implying these are usable APIs. Yet the document elsewhere labels computer vision and LLM integration as future enhancements, so the examples overstate what currently exists and misrepresent implemented behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.