Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says, but it gives an agent broad screen-capture ability, including ongoing watch mode, without clear consent, privacy, or retention safeguards.
Review carefully before installing. Use it only when you intentionally want the agent to see the current Mac screen, close or hide sensitive windows first, prefer one-shot captures, and avoid watch mode unless you understand that it can keep saving screenshots to disk.
The skill invokes shell commands but does not declare any tool scope such as permissions or allowed-tools. That weakens policy enforcement and reviewability, making it easier for an agent to use shell access for screen capture without clear authorization boundaries.
The description promotes capturing the current screen but omits any privacy warning about sensitive on-screen content. In this context, that omission is dangerous because screenshots may expose credentials, messages, documents, or other private data, and the skill even supports periodic watch mode which amplifies collection risk.
The invocation guidance is broad enough to encourage screen capture for vague situations like 'remote awareness' or checking what app is open. Because screenshots can contain highly sensitive data from any visible application, ambiguous triggers increase the chance of unnecessary or non-consensual collection.
This skill is explicitly designed to capture the current macOS screen, which can include passwords, messages, tokens, confidential documents, or unrelated user activity, and it writes those images to disk without any built-in warning, confirmation, minimization, or retention controls. In an agent context, this is more dangerous because the tool enables remote visual surveillance of the host state beyond the immediate task and may silently persist sensitive screenshots in predictable locations like /tmp.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run(cmd, timeout=10):
try:
r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout, shell=isinstance(cmd, str))
return r.stdout.strip(), r.returncode
except Exception as e:
return str(e), 1
No suspicious patterns detected.