Mano Cua A

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.0.0

Overview

The skill clearly describes desktop control, but it asks users to install changing external native components that could receive screen-control permissions without pinned versions or hashes in the reviewed artifact.

Install only if you trust the mano-cua publisher and its release channel. Prefer local mode for private work, avoid using it on sensitive accounts unless you can monitor and stop it, and look for pinned release versions plus hashes or signatures before running the binary or its SDK/model installers.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned External Executable and Secondary Component Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5, 21–27, 65–67, and 137–138
Vulnerability Type: Supply-chain exposure through mutable, externally hosted executables and components
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw": {"emoji": "🖥️", "install": [{"id": "brew", "kind": "brew", "formula":"Mininglamp-AI/tap/mano-cua", "bins":["mano-cua"],"label": "Install mano-cua (brew)"}]}}

markdown

**macOS / Linux (Homebrew):**

```bash
brew install Mininglamp-AI/tap/mano-cua

Windows:

Download the latest mano-cua-windows.zip from GitHub Releases, extract it, and add the folder to your PATH.

text

```bash
mano-cua check
mano-cua install-sdk
mano-cua install-model

markdown

- The full source code is [open source on GitHub](https://github.com/Mininglamp-AI/mano-skill) under MIT-0 license. The Homebrew formula builds directly from tagged GitHub releases with verifiable checksums.
- All network calls are isolated in a single module ([`task_model.py`](https://github.com/Mininglamp-AI/mano-skill/blob/main/visual/model/task_model.py)) for easy auditing.

Technical Analysis

The Skill directs users to install and execute mano-cua from a third-party Homebrew tap or an unpinned “latest” GitHub release. It also directs the installed executable to retrieve an SDK and model. The reviewed package contains no executable source, Homebrew formula, immutable release identifier, expected cryptographic digest, signature, lockfile, or verification command.

Although the documentation states that tagged releases have verifiable checksums, it does not pin a specific release or provide a trusted checksum against which the downloaded artifact must be verified. Consequently, the executable evaluated at installation time can differ from the artifact that existed when the Skill documentation was reviewed. ...[truncated 2352 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the Homebrew installation to a specific immutable release and audited formula revision rather than relying on the current state of a mutable tap.
2. Replace “latest” Windows download instructions with a specific versioned release URL.
3. Publish SHA-256 or stronger digests for every platform artifact in a trusted, version-controlled location and provide explicit verification commands before extraction or execution.
4. Prefer signed releases and verify platform-native signatures or Sigstore attestations. Document the trusted signer identity and fail installation when verification fails.
5. Document the exact URLs, versions, hashes, and signatures used by install-sdk and install-model. Ensure those commands reject unsigned or hash-mismatched content.
6. Include or vendor the relevant installer and networking source in the reviewed package, or pin links to immutable commit hashes so the implementation reviewed cannot change silently.
7. Apply least privilege operationally: request accessibility and screen-capture permissions only when required, avoid elevated installation or execution, and clearly distinguish permissions needed for local and cloud modes.
8. Document cloud endpoints, authentication, screenshot retention, redaction, and transport controls so privacy claims can be independently verified.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

> **--app vs --url:** Use one or the other, not both. `--app` launches a desktop application by its macOS name (as shown in Spotlight search). `--url` opens a URL in the default browser. Both bring the target to the foreground before the agent starts.

> **Tip for local mode:** Write task descriptions with explicit step-by-step instructions for best results. For example, instead of "search for iphone on Xiaohongshu", write "click the search box at the top, type iphone, click the search button, then click the first result". Explicit steps significantly improve local model accuracy.

## Local Mode

Static analysis

No suspicious patterns detected.