Back to skill

Security audit

wine desktop automation

Security checks across malware telemetry and agentic risk

Overview

This is a broad local desktop and Wine automation skill whose powerful actions are mostly disclosed and fit its purpose, but it should only be used with precise user-controlled tasks.

Install only if you need local GUI/Wine automation and trust the workflows that will call it. Keep sensitive windows closed, avoid typing secrets through the skill, use exact window titles or process names where possible, and require explicit human approval before launching unknown executables, saving screenshots, killing windows/processes, or changing Wine prefixes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
logger.info(f'Launching Wine application: {executable}')
            logger.debug(f'Command: {" ".join(cmd)}')
            
            process = subprocess.Popen(
                cmd,
                cwd=working_dir,
                env=env,
Confidence
96% confidence
Finding
process = subprocess.Popen( cmd, cwd=working_dir, env=env, stdout=subprocess.PIPE, stderr=subprocess.PIPE

subprocess module call

Medium
Category
Dangerous Code Execution
Content
logger.info(f'Launching Wine application with config: {executable}')
            logger.debug(f'Command: {" ".join(cmd)}')
            
            process = subprocess.Popen(
                cmd,
                cwd=working_dir,
                env=env,
Confidence
97% confidence
Finding
process = subprocess.Popen( cmd, cwd=working_dir, env=env, stdout=subprocess.PIPE, stderr=subprocess.PIPE

subprocess module call

Medium
Category
Dangerous Code Execution
Content
try:
            os.makedirs(self._wine_prefix, exist_ok=True)
            
            result = subprocess.run(
                [self._wine_path, 'wineboot', '--init'],
                env={'WINEPREFIX': self._wine_prefix},
                capture_output=True,
Confidence
83% confidence
Finding
result = subprocess.run( [self._wine_path, 'wineboot', '--init'], env={'WINEPREFIX': self._wine_prefix}, capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Content
try:
            logger.debug(f'Running Wine command: {" ".join(cmd)}')
            result = subprocess.run(
                cmd,
                cwd=working_dir,
                env=env,
Confidence
99% confidence
Finding
result = subprocess.run( cmd, cwd=working_dir, env=env, capture_output=True, text=True )

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def kill_by_pid(self, pid: int) -> bool:
        try:
            subprocess.run(['kill', str(pid)], check=True)
            logger.info(f'Killed Wine process: {pid}')
            return True
        except subprocess.CalledProcessError as e:
Confidence
93% confidence
Finding
subprocess.run(['kill', str(pid)], check=True)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def terminate_by_pid(self, pid: int) -> bool:
        try:
            subprocess.run(['kill', '-TERM', str(pid)], check=True)
            logger.info(f'Terminated Wine process: {pid}')
            return True
        except subprocess.CalledProcessError as e:
Confidence
92% confidence
Finding
subprocess.run(['kill', '-TERM', str(pid)], check=True)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill advertises powerful capabilities that imply shell execution, environment manipulation, and file-writing behavior, but it does not declare permissions or clearly constrain those operations. In a desktop-automation skill, these capabilities materially increase risk because they can be used to launch programs, alter Wine prefixes, and affect the local system beyond simple UI interaction.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose is desktop GUI automation, but the described behavior expands into broader system/process control such as arbitrary Wine command execution, prefix management, process termination, and window killing. This mismatch is dangerous because it hides higher-risk capabilities behind a benign automation label, making it easier for an agent or user to invoke unexpectedly powerful actions on the host system.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The controller exposes a direct wrapper for sending Ctrl+Alt+Delete, a privileged system-level key sequence that exceeds ordinary application UI automation and can trigger security-sensitive OS screens or disrupt the desktop session. In an agent skill that automates keyboard input, this increases the blast radius of misuse because an untrusted prompt or higher-level workflow could invoke system actions rather than just interact with an application window.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill description promises desktop mouse/keyboard automation, but the code also provides Wine environment management and arbitrary executable launching. This capability mismatch is dangerous because it hides materially more powerful execution behavior than a user or reviewer would expect from the stated purpose.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The run_command interface is an unjustified arbitrary execution capability. In the context of a desktop automation skill, this creates a generic mechanism to execute Windows commands under Wine, greatly increasing the chance of misuse or compromise.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
Creating Wine prefixes changes filesystem state and initializes a runtime environment beyond simple desktop automation needs. This broader capability can be misused to stage or persist tooling inside separate Wine environments without clear necessity.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The file implements host-level process discovery, termination, monitoring, and wineserver restart logic that exceeds the declared skill purpose of mouse/keyboard desktop automation. Scope expansion like this is dangerous because it grants operational control over local processes that users and reviewers would not reasonably expect from the manifest, increasing abuse potential and reducing transparency.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The skill can kill individual processes, kill all Wine processes, and restart wineserver without demonstrating a strict operational need or guardrails. In a desktop automation environment, this capability can be exploited for denial of service, forced shutdown of active applications, loss of user state, and tampering with the runtime of other Wine-based software.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The screenshot method can capture arbitrary screen contents and optionally persist them to disk with no access control, consent check, redaction, or destination validation. In a desktop automation skill, screenshots may include sensitive information from other applications, credentials, documents, or personal data, so silent saving increases privacy and data-exposure risk.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The template-saving helper captures a selected screen region and writes it to a caller-supplied filename, which can persist sensitive UI content without notice. In this skill's GUI automation context, that region could include secrets or regulated data from the desktop session, making unintended collection and storage more dangerous than in a non-UI tool.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
This module can type arbitrary text and issue broad keystrokes and hotkeys such as delete, cut, save, select-all, alt-tab, and other session-affecting commands without target validation, safety interlocks, or user confirmation. In a desktop automation skill, that means a misdirected or malicious instruction could modify files, send unintended input to the wrong window, or disrupt the active session, making the capability inherently risky in this context.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The module exposes `close` and especially `kill` operations that can terminate arbitrary GUI windows based only on a fuzzy title match, with no confirmation, allowlist, or safety interlock. In a desktop automation skill, this increases the chance of accidental or unauthorized disruption, data loss from unsaved work, or targeted termination of security-relevant prompts or applications.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
Installing fonts copies caller-specified files into the Wine prefix without confirmation or policy checks. Even if intended for customization, it is an undisclosed write operation that can be abused to place arbitrary files in a managed environment.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
Wine prefix creation makes directories and runs initialization commands that modify the local filesystem without obvious user-facing disclosure. Hidden state-changing behavior is risky in agent skills because it can surprise operators and facilitate unintended persistence or resource usage.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Destructive kill operations are exposed as simple methods with no confirmation flow, warning, or documentation indicating that they may terminate active user applications. That makes accidental misuse and unsafe autonomous invocation more likely, especially in an agent skill expected to perform GUI automation rather than system administration.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.