pyautogui-skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:11 PM UTC
• Version: 1.0.0

Overview

This is a coherent desktop-automation skill, but it deserves review because it controls the active desktop and one helper prints all text it types.

Review before installing if you plan to use it with sensitive apps or data. Run it only when you can watch the desktop, keep PyAutoGUI fail-safe enabled, avoid typing passwords or tokens through scripts/type_sequence.py, avoid full-screen screenshots when sensitive content is visible, and install dependencies in a least-privileged virtual environment where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4
• Finding: Unpinned Third-Party Python Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:4` and `SKILL.md:310` **Vulnerability Type**: Supply-chain exposure through unpinned dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: { "openclaw": { "emoji": "🖱️", "requires": { "bins": ["python3"], "pip": ["pyautogui", "pyscreeze"] } } } ``` ```bash pip install pyautogui pyscreeze pillow ``` ### Technical Analysis The Skill declares and instructs installation of `pyautogui`, `pyscreeze`, and `pillow` without exact version constraints or package integrity hashes. Consequently, the package manager may retrieve whichever releases satisfy the request at installation time, including mutable future releases and their transitive dependencies. No evidence indicates that the currently named packages are malicious. The vulnerability is the absence of dependency controls, which prevents reproducible installation and increases exposure to compromised upstream releases, dependency confusion in misconfigured package environments, and unexpected security regressions. ### Attack Path 1. An attacker compromises an upstream package release, a transitive dependency, or the package index/account used to distribute it. 2. A user or automated environment installs the Skill requirements using the unpinned dependency declaration or documented `pip install` command. 3. `pip` resolves and downloads the affected release because no reviewed version or integrity hash is required. 4. Malicious installation behavior or code imported at runtime executes under the Python process's user account. 5. The payload can access resources available to that account and abuse the desktop-automation permissions granted to the Python environment. ### Impact Assessment Successful exploitation could execute arbitrary Python code with the privileges of the account installing or running the Skill. The accessible scope may include that user's files, environment variables, GUI session, clipboard, and network acce ...[truncated 200 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to a reviewed exact version, for example: ```text pyautogui==<reviewed-version> pyscreeze==<reviewed-version> pillow==<reviewed-version> ``` 2. Generate a lock file that includes resolved transitive dependencies. 3. Require cryptographic hashes during installation, such as with a hash-locked requirements file and `pip install --require-hashes`. 4. Install packages only from an explicitly trusted package index. 5. Run dependency vulnerability and provenance checks in CI. 6. Perform installation inside an isolated virtual environment under a non-administrative account. 7. Establish a controlled update process in which version changes are reviewed and tested before release. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/type_sequence.py:16
• Finding: Plaintext Disclosure of Text Entered Through Desktop Automation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/type_sequence.py:16-22` **Vulnerability Type**: Plaintext sensitive-data logging **Risk Level**: Medium ### Vulnerable Code ```python def type_text(text, interval=0.1): """Type text with specified interval between characters.""" print(f"Typing: {text}") print(f"Interval: {interval}s") pyautogui.write(text, interval=interval) print("Done!") ``` ### Technical Analysis The function prints the complete text value immediately before typing it into the active GUI. The Skill documentation advertises form-filling workflows, so the value may contain passwords, access tokens, personal information, private messages, or other confidential data. Terminal output may be retained by agent execution records, CI logs, shell-session capture, remote administration systems, or observability tooling. Printing the value therefore creates an unnecessary additional plaintext copy beyond the intended GUI destination. The argument is also supplied through the command line, which can expose it through shell history or process inspection on some systems. The confirmed code-level issue is the explicit plaintext output at line 18. ### Attack Path 1. A user or Agent invokes `type_sequence.py` with confidential text intended for a GUI field. 2. `type_text()` interpolates the complete value into `print(f"Typing: {text}")`. 3. The plaintext value is emitted to standard output. 4. An execution framework, terminal logger, CI system, or session recorder retains the output. 5. A user or service with access to those records retrieves the confidential value. ### Impact Assessment Exploitation does not directly grant additional operating-system privileges. Its impact is disclosure of the exact text supplied to the script. Depending on that text, an attacker with log access could obtain credentials, tokens, personal data, or other secrets and then exercise the permissions associated with those credentials. The ...[truncated 186 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove plaintext value logging. Report only non-sensitive metadata: ```python def type_text(text, interval=0.1): print(f"Typing {len(text)} characters") print(f"Interval: {interval}s") pyautogui.write(text, interval=interval) print("Done!") ``` 2. Provide an explicit sensitive-input mode that reads from standard input without echoing, using `getpass.getpass()` where appropriate. 3. Avoid placing secrets directly in command-line arguments because they may be retained in shell history or exposed through process inspection. 4. Make verbose content logging opt-in and clearly warn users that it must never be enabled for sensitive values. 5. Ensure execution and Agent logs apply secret redaction and have restrictive access controls and retention periods. 6. Document that GUI automation should not be used to enter secrets unless the invocation and logging environment have been reviewed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The keyboard shortcut examples include actions like save, creating folders, and launching system search without warning that GUI automation can trigger unintended state changes in the active application or operating system. Because PyAutoGUI sends keystrokes to whatever window has focus, a mistaken target can modify files, execute shortcuts, or alter system state unexpectedly.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill documents screenshot capture and saving screen contents to disk without any explicit warning about privacy, sensitive on-screen data, or consent boundaries. In a desktop automation skill, screenshots may capture credentials, personal data, internal documents, or secrets visible on screen, so omission of privacy guidance is a real security weakness even if the examples are otherwise standard.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The window-management section documents app switching and window-closing shortcuts, including Alt+F4 and Command+W, without warning about unsaved work or accidental closure of the wrong application. In desktop automation, focus mistakes are common, so these examples can cause data loss or interrupt important user activity if reused without safeguards.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

3. **Linux:**
   ```bash
   sudo apt-get install python3-dev python3-pip
   sudo apt-get install scrot python3-tk python3-dev
   pip3 install pyautogui
   ```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

3. **Linux:**
   ```bash
   sudo apt-get install python3-dev python3-pip
   sudo apt-get install scrot python3-tk python3-dev
   pip3 install pyautogui
   ```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

3. **Linux:**
   ```bash
   sudo apt-get install python3-dev python3-pip
   sudo apt-get install scrot python3-tk python3-dev
   pip3 install pyautogui
   ```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.