Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent for desktop automation, but it can control, screenshot, launch, close, and kill live desktop/Wine applications without clear safety boundaries.
Install only if you are comfortable giving the skill live desktop control. Run it in a dedicated test desktop or VM when possible, keep sensitive windows closed, and review any automation script before allowing launches, screenshots, window kills, process kills, or Wine prefix changes.
The documented purpose does not clearly disclose that the skill can enumerate processes, terminate processes by name or PID, bulk-kill Wine processes, restart wineserver, and inspect process state. In a desktop environment, these controls can disrupt applications, destroy unsaved work, or be abused to interfere with other workloads, making the mismatch security-relevant rather than merely cosmetic.
The documented purpose does not clearly disclose that the skill can enumerate processes, terminate processes by name or PID, bulk-kill Wine processes, restart wineserver, and inspect process state. In a desktop environment, these controls can disrupt applications, destroy unsaved work, or be abused to interfere with other workloads, making the mismatch security-relevant rather than merely cosmetic.
The documented purpose does not clearly disclose that the skill can enumerate processes, terminate processes by name or PID, bulk-kill Wine processes, restart wineserver, and inspect process state. In a desktop environment, these controls can disrupt applications, destroy unsaved work, or be abused to interfere with other workloads, making the mismatch security-relevant rather than merely cosmetic.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
if args:
cmd.extend(args)
env = os.environ.copy()
env['WINEPREFIX'] = self._wine_prefix
try:
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
if args:
cmd.extend(args)
env = os.environ.copy()
env['WINEPREFIX'] = self._wine_prefix
try:
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
if args:
cmd.extend(args)
env = os.environ.copy()
env['WINEPREFIX'] = self._wine_prefix
try:
kill_all performs bulk termination of all detected Wine processes, which is especially dangerous because it can indiscriminately disrupt multiple applications and destroy unsaved user work. This breadth is hard to justify for a desktop automation skill and materially raises the impact of any misuse or prompt injection reaching the tool.
The skill declares powerful capabilities related to environment access, file writing, and shell execution but does not specify any tool scope or permission boundaries. For a desktop automation skill, this omission increases the risk that downstream automation can invoke broader system actions than users expect, especially when combined with Wine launch and process-management behaviors.
The main skill content is written in Chinese and presents the skill description and usage guidance in that language, while the file does not indicate that language selection is optional or region-specific. This can violate language/locale policy when users have not opted into Chinese-language interactions.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# 系统依赖（Ubuntu）
sudo apt-get install wine64 xdotool wmctrl scrot
# Python 依赖
pip install -r requirements.txt
The code captures the screen with pyautogui.screenshot() and optionally saves the result to a file, which can expose sensitive on-screen information and persist it to disk. While the code logs when a file is saved, it does not provide a warning or explanatory comment/docstring disclosing the privacy impact of screen capture itself.
save_template captures a screen region and saves it to a caller-specified filename, which is a file write involving potentially sensitive screen data. The function logs success but does not include a warning, docstring, or comment disclosing that it stores captured visual content on disk.
The skill provides screenshot-triggering shortcuts (printscreen, win+printscreen) without any privacy notice, consent check, or destination control. In GUI automation, this can capture sensitive on-screen information from unrelated applications, especially because keyboard automation acts on the live desktop rather than an isolated application context.
The wrapper exposes a direct ctrl+alt+delete automation primitive with no confirmation, policy check, or safety gating. In a desktop automation skill, synthesized privileged or disruptive key sequences can terminate sessions, interrupt user activity, or be chained into broader unsafe UI-driven actions if invoked on the wrong window or by untrusted input.
This module exposes direct mouse movement, clicking, dragging, and scrolling primitives that can perform destructive GUI actions without any safety interlocks, confirmation gates, target validation, or policy checks. In a desktop-automation skill, these actions can be driven by untrusted prompts or mistaken coordinates and may cause unintended clicks, data loss, application reconfiguration, or execution of sensitive actions on the host desktop.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def _check_xdotool(self):
try:
subprocess.run(['xdotool', '--version'],
capture_output=True, check=True)
except (subprocess.CalledProcessError, FileNotFoundError):
logger.error('xdotool not found. Please install it with: sudo apt-get install xdotool')
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def _run_xdotool(self, args: List[str]) -> str:
try:
result = subprocess.run(['xdotool'] + args,
capture_output=True,
text=True,
check=True)
The module exposes close and kill operations that can terminate windows based on fuzzy title matching, without any confirmation, scoping, or safety checks. In a desktop automation skill, that can cause accidental data loss, disruption of unrelated applications, or abuse to interfere with user activity if an upstream prompt or caller is manipulated.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def _check_wine(self):
try:
result = subprocess.run([self._wine_path, '--version'],
capture_output=True,
text=True,
check=True)
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
check=True)
logger.info(f'Wine version: {result.stdout.strip()}')
except (subprocess.CalledProcessError, FileNotFoundError) as e:
logger.error('Wine not found or not working. Please install Wine with: sudo apt-get install wine64')
raise RuntimeError('Wine is required but not installed or not working')
def launch(self, executable: str, args: Optional[List[str]] = None,
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
check=True)
logger.info(f'Wine version: {result.stdout.strip()}')
except (subprocess.CalledProcessError, FileNotFoundError) as e:
logger.error('Wine not found or not working. Please install Wine with: sudo apt-get install wine64')
raise RuntimeError('Wine is required but not installed or not working')
def launch(self, executable: str, args: Optional[List[str]] = None,
This launches an arbitrary executable and arguments through Wine based on caller-controlled input. Although it does not use a shell, it still enables execution of untrusted Windows binaries, which is especially risky in a desktop automation skill because invoking local programs is its core capability and can be abused to run malware or unsafe helper tools.
logger.info(f'Launching Wine application: {executable}')
logger.debug(f'Command: {" ".join(cmd)}')
process = subprocess.Popen(
cmd,
cwd=working_dir,
env=env,
This function constructs a Wine command from arbitrary config_options, executable, and args, then spawns it directly. Even without shell metacharacter injection, the caller can influence Wine behavior and execute untrusted code or unsafe Wine subcommands, making this a real execution-surface vulnerability in the context of an automation skill.
logger.info(f'Launching Wine application with config: {executable}')
logger.debug(f'Command: {" ".join(cmd)}')
process = subprocess.Popen(
cmd,
cwd=working_dir,
env=env,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def launch_winecfg(self) -> Optional[subprocess.Popen]:
try:
logger.info('Launching winecfg')
process = subprocess.Popen(
['winecfg'],
env={'WINEPREFIX': self._wine_prefix}
)
The code creates directories and initializes a Wine prefix on the local filesystem without any user-facing warning or confirmation. In an automation context, silent writes can surprise users, alter their local environment, and create persistence locations for later-executed Windows binaries.
No suspicious patterns detected.