Windows UI Automation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:20 PM UTC
• Version: 1.0.0

Overview

This Windows automation skill does what it claims, but it gives an agent broad raw mouse and keyboard control without enough targeting or confirmation safeguards.

Review this before installing if you expect agents to operate on a live Windows desktop. Use it only for explicit, user-directed GUI automation, verify the target window immediately before each action, avoid passing untrusted text to the typing helper, and require confirmation for clicks, special keys, form submissions, security dialogs, or destructive application actions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: keyboard_control.ps1.txt:7

Finding

Unescaped Text Is Interpreted as SendKeys Control Syntax

Content

View full analysis

Vulnerability Details

File Location: keyboard_control.ps1.txt, lines 7-9
Vulnerability Type: Keyboard input injection through unsafe SendKeys interpretation
Risk Level: Medium

powershell

if ($Text) {
    [System.Windows.Forms.SendKeys]::SendWait($Text)
}

Technical Analysis

The -Text parameter is passed directly to System.Windows.Forms.SendKeys.SendWait(). This API does not treat its argument as literal text: characters such as +, ^, %, ~, parentheses, and braces have special meanings representing modifier keys, key combinations, repetition, or named keys.

The accompanying documentation presents -Text as a facility for typing ordinary text. Consequently, data containing SendKeys metacharacters can be interpreted as keyboard commands without the caller intending or recognizing that behavior. If untrusted content reaches this parameter, an attacker can construct text that activates shortcuts in whichever window currently has focus.

Attack Path

1. An attacker supplies or influences text that an agent is asked to type into a desktop application.
2. The agent invokes keyboard_control.ps1.txt and passes that content through the -Text parameter.
3. The script forwards the content unchanged to SendWait().
4. SendKeys parses embedded metacharacters as modifier keys or special-key expressions rather than literal characters.
5. The resulting shortcut is delivered to the currently focused window, causing an action such as submitting a form, opening an application command, changing content, or closing a document.

Exploitation requires the script to be invoked with attacker-influenced text while an actionable desktop window has focus.

Impact Assessment

Successful exploitation can perform unintended GUI actions with the permissions and interactive desktop access of the user running the script. The affected scope is the active Windows session and applications accessible to th ...[truncated 425 chars]

Remediation

View remediation

Remediation Suggestions

• Treat -Text strictly as literal text and escape every SendKeys metacharacter before passing it to SendWait().
• Keep literal text entry and special-key operations in separate code paths. Do not permit raw SendKeys expressions through the text-entry path.
• Restrict -Key to an explicit allowlist of required named keys and combinations rather than accepting arbitrary SendKeys syntax.
• Require the caller to identify the intended target window, activate it, and verify that it has focus immediately before injecting input.
• Add confirmation or policy checks before sending shortcuts capable of destructive or security-sensitive actions.
• Add tests covering literal input containing +, ^, %, ~, parentheses, braces, and bracket-like key expressions.
• Where feasible, use a text-entry mechanism that inserts literal Unicode text without interpreting control syntax, while avoiding clipboard use for sensitive content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description is broad enough to match many ordinary desktop interaction requests, which can cause the agent to invoke powerful GUI automation in situations where safer, narrower tools would be preferable. Because this skill can generate mouse and keyboard input at the OS level, over-triggering increases the chance of unintended clicks, text entry, or interaction with sensitive windows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill enables direct desktop input automation but does not warn that simulated mouse and keyboard actions can be destructive, irreversible, or target the wrong window if focus changes. In this context, missing safety guidance is particularly dangerous because OS-level input can send commands, approve dialogs, alter system settings, or expose data across unrelated applications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends arbitrary keystrokes directly to whatever window currently has focus using SendKeys, with no confirmation, target validation, or safety interlock. In a GUI automation skill, this can cause unintended commands, data entry, credential leakage, or destructive actions if the wrong application is focused or if untrusted input is passed into $Text or $Key.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This script can move the cursor and inject left/right/double-click events directly into the Windows desktop session with no user confirmation, target validation, or safety interlocks. In an agent skill context, that makes unintended or deceptive UI actions possible, including clicking security prompts, altering application state, or interacting with sensitive windows based solely on upstream instructions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.