ClawHub
Back to skill

Security audit

pyautogui-skill

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent desktop-automation skill, but it deserves review because it controls the active desktop and one helper prints all text it types.

Review before installing if you plan to use it with sensitive apps or data. Run it only when you can watch the desktop, keep PyAutoGUI fail-safe enabled, avoid typing passwords or tokens through scripts/type_sequence.py, avoid full-screen screenshots when sensitive content is visible, and install dependencies in a least-privileged virtual environment where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:4
Finding

Unpinned Third-Party Python Dependencies

Content
View full analysis
Remediation
View remediation
pyscreeze== pillow== ``` 2. Generate a lock file that includes resolved transitive dependencies. 3. Require cryptographic hashes during installation, such as with a hash-locked requirements file and `pip install --require-hashes`. 4. Install packages only from an explicitly trusted package index. 5. Run dependency vulnerability and provenance checks in CI. 6. Perform installation inside an isolated virtual environment under a non-administrative account. 7. Establish a controlled update process in which version changes are reviewed and tested before release. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/type_sequence.py:16
Finding

Plaintext Disclosure of Text Entered Through Desktop Automation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The keyboard shortcut examples include actions like save, creating folders, and launching system search without warning that GUI automation can trigger unintended state changes in the active application or operating system. Because PyAutoGUI sends keystrokes to whatever window has focus, a mistaken target can modify files, execute shortcuts, or alter system state unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documents screenshot capture and saving screen contents to disk without any explicit warning about privacy, sensitive on-screen data, or consent boundaries. In a desktop automation skill, screenshots may capture credentials, personal data, internal documents, or secrets visible on screen, so omission of privacy guidance is a real security weakness even if the examples are otherwise standard.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The window-management section documents app switching and window-closing shortcuts, including Alt+F4 and Command+W, without warning about unsaved work or accidental closure of the wrong application. In desktop automation, focus mistakes are common, so these examples can cause data loss or interrupt important user activity if reused without safeguards.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.

  1. Linux:
    bash
    sudo apt-get install python3-dev python3-pip
sudo apt-get install scrot python3-tk python3-dev
pip3 install pyautogui

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.

  1. Linux:
    bash
    sudo apt-get install python3-dev python3-pip
sudo apt-get install scrot python3-tk python3-dev
pip3 install pyautogui

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 333)May include surrounding context.

  1. Linux:
    bash
    sudo apt-get install python3-dev python3-pip
sudo apt-get install scrot python3-tk python3-dev
pip3 install pyautogui