Security audit
Security checks across malware telemetry and agentic risk
This appears to be a genuine Windows automation skill, but it gives broad desktop control and uses unsafe PowerShell command construction that users should review before installing.
Install only if you intentionally want an agent to control a Windows desktop. Use it in a non-sensitive session, avoid running the agent as administrator, keep private content off screen, and require explicit confirmation before screenshots, clicks, typing, URL launches, form submissions, saves, or process kills. Treat all paths, URLs, window titles, typed text, and process names as trusted-only inputs until the PowerShell escaping issues are fixed.
ps_cmd += f" -Wait -Timeout {timeout}"
# 执行PowerShell命令
result = subprocess.run(
["powershell", "-Command", ps_cmd],
capture_output=True,
text=True,"""
try:
ps_cmd = f"Stop-Process -Name '{process_name}' -Force"
result = subprocess.run(
["powershell", "-Command", ps_cmd],
capture_output=True,
text=True$wshell.SendKeys("{text}")
'''
result = subprocess.run(
["powershell", "-Command", ps_script],
capture_output=True,
text=True,[Mouse]::SetCursorPos({x}, {y})
'''
result = subprocess.run(
["powershell", "-Command", ps_script],
capture_output=True,
text=True,}}
'''
subprocess.run(
["powershell", "-Command", ps_script],
capture_output=True,
text=True,[Mouse]::mouse_event(0x0800, 0, 0, {scroll_amount}, 0)
'''
subprocess.run(
["powershell", "-Command", ps_script],
capture_output=True,
text=True,Write-Output "{output_path}"
'''
result = subprocess.run(
["powershell", "-Command", ps_script],
capture_output=True,
text=True,}}
'''
result = subprocess.run(
["powershell", "-Command", ps_script],
capture_output=True,
text=True,67/67 vendors flagged this skill as clean.
No suspicious patterns detected.