ClawHub
Back to skill

Security audit

windows-automation

Security checks for vulnerabilities and agentic risk

Overview

This Windows automation skill matches its stated purpose, but it can control the desktop and has unsafe PowerShell command construction that needs review before installation.

Review this skill carefully before installing. It is not backed by evidence of exfiltration or persistence, but it can manipulate the live Windows desktop, capture visible information, terminate processes, and execute PowerShell built from user-provided values. It should be used only in a controlled environment after adding strict input validation, allowlists, explicit confirmations, and safer APIs that do not interpolate user input into PowerShell source.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/app_launcher.py:28
Finding

PowerShell Command Injection in Application Launch Parameters

Content
View full analysis
` or `app_launcher.py url `. 3. The script inserts the value into `Start-Process -FilePath ''`. 4. A quote in the value closes the intended string, after which injected PowerShell statements are parsed. 5. PowerShell executes the appended commands with the privileges of the Python/Agent process. ### Impact Assessment Successful exploitation provides arbitrary command execution under the current Age ...[truncated 319 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/app_launcher.py:104
Finding

PowerShell Command Injection in Process Termination

Content
View full analysis
`. 3. The script embeds the process name in the `Stop-Process` command. 4. PowerShell parses injected syntax following a prematurely closed string. 5. The injected statements execute as the current Agent account. ### Impact Assessment The attacker can execute arbitrary PowerShell commands with the permissions of the automation process. This could enable unauthorized file access, process execution, system modification, or persistence where the current account has sufficient rights. Even without command injection, unrestricted use of `Stop-Process -Force` can cause availability loss if the Skill is allowed to terminate arbitrary user processes. ]]>
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/keyboard_control.py:57
Finding

PowerShell Command Injection Through Keyboard Text Input

Content
View full analysis
")`. 4. Crafted syntax escapes the intended string or invokes PowerShell interpolation. 5. PowerShell executes attacker-controlled commands under the Agent's account. ### Impact Assessment Successful exploitation yields arbitrary command execution with the privileges of the Python/Agent process. Accessible files, applications, user data, and system settings could be affected. The vulnerability is especially exposed because arbitrary free-form text is an expected input for the Skill's normal form-filling workflows. ]]>
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/screenshot.py:31
Finding

PowerShell Command Injection Through Full-Screen Screenshot Output Path

Content
View full analysis
`. 3. The path is interpolated into `$bitmap.Save()` and `Write-Output`. 4. PowerShell parses injected syntax from the crafted path. 5. The injected command executes with the Agent process's privileges. ### Impact Assessment An attacker can potentially execute arbitrary commands as the current Agent account. In addition, unrestricted output paths allow screenshot files to be writt ...[truncated 157 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/screenshot.py:94
Finding

PowerShell Command Injection Through Window Screenshot Parameters

Content
View full analysis
`. 3. `capture_window()` inserts both values into a PowerShell script. 4 ...[truncated 526 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (45)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill describes capabilities for screenshots, keyboard simulation, mouse control, application launching, URL opening, and process termination without prominent warnings about privacy, security, and system impact. In this context, those actions can expose sensitive on-screen data, inject input into the wrong window, terminate important processes, or drive the machine in ways the user does not fully understand.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation advertises high-impact capabilities including screenshots, keyboard/mouse control, URL opening, and process termination, but it does not clearly warn about privacy exposure, unintended system changes, or risks to active user sessions. In an automation skill, omission of these warnings makes unsafe use more likely and reduces informed consent for sensitive operations.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list for application control uses broad everyday phrases such as opening or closing apps/websites without requiring a constrained invocation pattern, which increases the chance of accidental activation. In a Windows automation skill, accidental triggering can launch programs or URLs and cause unintended system actions with security and privacy consequences.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Mouse and keyboard triggers include very generic verbs like click, type, and shortcut, making activation conditions unclear for actions that directly control the user's desktop. In this context, misfires can send input to the wrong window, approve prompts, alter documents, or trigger destructive shortcuts.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The 'other' trigger category contains extremely broad terms like automation, RPA, and control app, which effectively widen activation to many unrelated user requests. For a skill capable of screenshots, process killing, and simulated input, this lack of boundary makes unintended invocation significantly more dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description advertises capabilities including application control, screenshots, mouse control, and keyboard simulation but does not warn users that these are high-risk actions capable of manipulating the desktop, capturing sensitive information, or interfering with active sessions. Because this skill operates at the UI layer and can automate powerful actions, missing safety warnings increases the likelihood of unsafe use and insufficient user consent.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes broad everyday phrases such as “点击”, “截图”, “自动化”, and “关闭应用”, which can match many benign user requests and unintentionally invoke powerful desktop-control actions. In the context of a Windows automation skill that can launch apps, kill processes, simulate keyboard input, and capture screens, accidental triggering could cause unauthorized UI actions, data exposure, or disruption.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list is broad enough to activate on common requests like opening apps, taking screenshots, clicking, or typing without strong constraints that the user explicitly wants desktop automation. In an agent setting, this can cause the skill to be selected for sensitive actions that affect the host system, increasing the chance of unintended execution, privacy violations, or disruptive UI control.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The primary trigger section includes ambiguous standalone activators such as '点击', '截图', and '打开 [应用名称]' that may match routine conversational requests rather than deliberate consent to device automation. Because this skill can simulate input and control applications, ambiguous activation materially raises the risk of the agent performing real system actions when the user may have intended only informational assistance.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module presents itself as an application launcher but also provides process enumeration and force-kill capabilities. This mismatch expands operational scope in a way users or higher-level agents may not expect, increasing the risk of misuse for host reconnaissance and service disruption.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
98% confidence
Finding

start_app builds a PowerShell command string by interpolating untrusted app_path, arguments, and working_dir directly into ps_cmd and then executes it with powershell -Command. Because single quotes in attacker-controlled input can break out of the quoted context, this creates a command injection path that can execute arbitrary PowerShell commands under the current user's privileges.

Content

Scanner excerpt · scripts/app_launcher.py (reported line 39)May include surrounding context.

python
ps_cmd += f" -Wait -Timeout {timeout}"

        # 执行PowerShell命令
        result = subprocess.run(
            ["powershell", "-Command", ps_cmd],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/app_launcher.py (reported line 91)May include surrounding context.

python
"""
    try:
        ps_cmd = "Get-Process | Select-Object Name, Id, Path | ConvertTo-Json"
        result = subprocess.run(
            ["powershell", "-Command", ps_cmd],
            capture_output=True,
            text=True

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The force-kill functionality uses Stop-Process -Force with no confirmation, policy check, or safeguard. In an agent skill context, this makes accidental or malicious disruption easier by allowing arbitrary process termination without friction, potentially killing security tools, productivity apps, or critical user processes.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
97% confidence
Finding

kill_app interpolates untrusted process_name into a PowerShell Stop-Process command string and executes it via powershell -Command. An attacker can inject quotes or additional PowerShell syntax to run arbitrary commands, and even without injection the function enables forceful termination of arbitrary processes, which can be abused for denial of service.

Content

Scanner excerpt · scripts/app_launcher.py (reported line 126)May include surrounding context.

python
"""
    try:
        ps_cmd = f"Stop-Process -Name '{process_name}' -Force"
        result = subprocess.run(
            ["powershell", "-Command", ps_cmd],
            capture_output=True,
            text=True

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This skill can send arbitrary keystrokes and hotkeys to whatever application has focus, which can trigger destructive actions, data exfiltration, or unintended confirmations without any warning, consent boundary, or safety gating. In an agent skill context, UI automation is more dangerous because it can affect external applications and sensitive user sessions outside the skill's own scope.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
94% confidence
Finding

This PowerShell subprocess executes a dynamically constructed script that embeds untrusted text directly into a SendKeys call. If the input contains quotes or PowerShell metacharacters, it can break out of the intended string context and alter the script being run, turning keyboard automation into command/script injection with the privileges of the current user.

Content

Scanner excerpt · scripts/keyboard_control.py (reported line 63)May include surrounding context.

python
$wshell.SendKeys("{text}")
        '''

        result = subprocess.run(
            ["powershell", "-Command", ps_script],
            capture_output=True,
            text=True,

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

With no manifest available, the documented purpose is limited to keyboard input simulation. Implementing that by invoking external PowerShell processes adds a command-execution capability beyond the apparent need of a keyboard-control utility, since the same behavior could be implemented directly without spawning a shell.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/keyboard_control.py (reported line 120)May include surrounding context.

python
[Keyboard]::keybd_event({key_code}, 0, [Keyboard]::KEYEVENTF_KEYUP, 0)
        '''

        subprocess.run(
            ["powershell", "-Command", ps_script],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/keyboard_control.py (reported line 186)May include surrounding context.

python
[Keyboard]::keybd_event({key_code}, 0, [Keyboard]::KEYEVENTF_KEYUP, 0)
        '''

        subprocess.run(
            ["powershell", "-Command", ps_script],
            capture_output=True,
            text=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill exposes mouse movement and clicking primitives that act on the live system without user confirmation, disclosure, or environmental safeguards. In an agent skill context, this is dangerous because UI automation can be chained to dismiss warnings, authorize actions, manipulate applications, or interfere with a user's desktop unexpectedly.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The docstring says the relative parameter controls whether movement is relative, implying movement offset from the current cursor position. However, both the relative=True and relative=False branches call SetCursorPos(x, y), which sets an absolute screen position in either case.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mouse_control.py (reported line 28)May include surrounding context.

python
try:
        # 获取当前屏幕尺寸
        ps_cmd = "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds | Select-Object Width, Height | ConvertTo-Json"
        result = subprocess.run(
            ["powershell", "-Command", ps_cmd],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
90% confidence
Finding

This code builds a PowerShell script with Python f-string interpolation of x and y, then executes it via PowerShell. Although the CLI path casts arguments to integers, the function itself accepts untrusted parameters and, if imported or reused elsewhere, could permit script injection or unintended UI control on the host system.

Content

Scanner excerpt · scripts/mouse_control.py (reported line 74)May include surrounding context.

python
[Mouse]::SetCursorPos({x}, {y})
            '''

        result = subprocess.run(
            ["powershell", "-Command", ps_script],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
86% confidence
Finding

This subprocess call executes PowerShell-generated mouse click automation against the live desktop without any privilege separation or execution guard. In an agent skill context, such UI-driving capability can be abused to perform unintended clicks, approve prompts, or interfere with the user session.

Content

Scanner excerpt · scripts/mouse_control.py (reported line 140)May include surrounding context.

python
}}
        '''

        subprocess.run(
            ["powershell", "-Command", ps_script],
            capture_output=True,
            text=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Drag-and-drop is a higher-risk UI automation primitive because it can move files, reorder data, change settings, or trigger unintended destructive state changes in arbitrary applications. The lack of confirmation or context restrictions makes the skill materially more dangerous in an agent environment.

Content

No source excerpt is available for this finding.