Mac Use 1.0.0

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:40 AM UTC
• Version: 1.0.0

Overview

This Mac desktop-control skill is mostly purpose-aligned, but it needs broad screen and input permissions and has unsafe input, temporary-file, and install practices that deserve review before use.

Install only if you are comfortable granting the host process Screen Recording and Accessibility permissions, because the skill can see windows and send clicks or keystrokes to desktop apps. Avoid using it around passwords, private messages, financial apps, admin prompts, or irreversible actions. Prefer running it in a dedicated environment, use a virtualenv with pinned dependencies, and clear /tmp/mac_use*. files after use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mac_use.py:545

Finding

AppleScript Injection Through Unescaped Keyboard Input

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mac_use.py:36

Finding

Predictable Shared Temporary Files Allow Symlink and State-Tampering Attacks

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Dependencies Are Installed Into the Managed Python Environment

Content

View full analysis

=12.0 pyautogui>=0.9 Pillow>=10.0 ``` The documented installation command is: ```bash pip3 install --break-system-packages -r {baseDir}/requirements.txt ``` ### Technical Analysis All dependencies use open-ended minimum-version constraints. Consequently, installation can resolve to future package versions and changing transitive dependency graphs that were not part of the audited artifact. There is no lockfile, exact version pinning, or hash verification. Package installation may execute build backends or installation-related code, so compromise of an upstream package or dependency can affect the host during setup. The recommended `--break-system-packages` option bypasses protections for externally managed Python installations. This increases the blast radius by modifying a shared Python environment instead of containing the packages within a dedicated virtual environment. No currently malicious or typosquatted package was identified in the reviewed dependency names. The vulnerability is the unsafe and non-reproducible dependency resolution and installation model. ### Attack Path 1. A dependency or transitive dependency publishes a compromised future release, or an upstream distribution account is compromised. 2. A user follows the documented installation command. 3. The open-ended constraints resolve to the unreviewed release. 4. Pip downloads the package without checking an expected artifact hash. 5. Package build or installation logic executes with the installer’s privileges. 6. The shared Python environment or user-accessible system is modified. ### Impact Assessment A compromised dependency can execute code with the privileges of the user performing installation. Depending ...[truncated 526 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill exposes powerful shell-based GUI automation and writes artifacts to /tmp, but it declares no explicit tool scope or permission boundaries. In an agent ecosystem, that increases the chance the skill is invoked with broader-than-necessary authority, enabling unintended command execution, app control, screenshot capture of sensitive data, and interaction with user applications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation condition is extremely broad—'interact with any Mac desktop application's graphical interface'—which can cause the skill to trigger for many unrelated requests. Because the skill can visually inspect windows, click, type, and send keys to arbitrary apps, overbroad activation materially raises the risk of misuse, accidental invocation, and unsafe handling of sensitive on-screen content.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

This AppleScript call interpolates the untrusted app_name directly into a script string without escaping. A crafted app name containing quotes or AppleScript syntax could break out of the string literal and execute unintended AppleScript actions, which is especially dangerous in a GUI automation skill that already has permission to control the desktop.

Content

Scanner excerpt · scripts/mac_use.py (reported line 133)May include surrounding context.

python

def activate_app(app_name):
    """Bring an app to the foreground."""
    subprocess.run(
        ["osascript", "-e", f'tell application "{app_name}" to activate'],
        capture_output=True,
        timeout=5,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

The AXRaise AppleScript is assembled from app_name and window_title, and only the title is escaped while app_name remains unescaped. Because both values may originate from externally influenced GUI state, this creates an AppleScript injection surface that could trigger arbitrary automation actions on the host.

Content

Scanner excerpt · scripts/mac_use.py (reported line 150)May include surrounding context.

python

f'to perform action "AXRaise" of window "{safe_title}"'
    )
    try:
        subprocess.run(["osascript", "-e", script], capture_output=True, timeout=5)
        time.sleep(0.3)
    except Exception:
        pass

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill captures full-screen content, crops application windows, performs OCR, and writes both the image and extracted text metadata to predictable files in /tmp without any user-facing consent, minimization, or cleanup. In the context of a desktop automation tool, this can expose secrets from emails, chats, documents, tokens, or other sensitive on-screen data to other local processes or later sessions.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mac_use.py (reported line 232)May include surrounding context.

python

def capture_full_screen():
    """Take a full-screen screenshot. Returns True on success."""
    r = subprocess.run(
        ["/usr/sbin/screencapture", "-x", SCREENSHOT_FULL],
        capture_output=True, timeout=10,
    )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill can inject global keystrokes and keycodes through System Events without any safety gate, focus verification, or user confirmation. If the wrong window is focused or input is attacker-influenced, this can trigger destructive actions such as sending messages, approving prompts, closing documents, or executing shortcuts in privileged applications.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

The keystroke_via_osascript helper inserts untrusted key text into an AppleScript string without escaping. An attacker controlling the combo or key value could inject additional AppleScript, leading to arbitrary GUI actions or command execution via AppleScript-capable apps.

Content

Scanner excerpt · scripts/mac_use.py (reported line 553)May include surrounding context.

python

else:
        mod_str = ""
    script = f'tell application "System Events" to keystroke "{key}"{mod_str}'
    r = subprocess.run(["osascript", "-e", script], capture_output=True, timeout=10)
    if r.returncode != 0:
        sys.stderr.write(f"osascript keystroke failed: {r.stderr.decode().strip()}\n")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mac_use.py (reported line 568)May include surrounding context.

python

else:
        mod_str = ""
    script = f'tell application "System Events" to key code {code}{mod_str}'
    r = subprocess.run(["osascript", "-e", script], capture_output=True, timeout=10)
    if r.returncode != 0:
        sys.stderr.write(f"osascript keycode failed: {r.stderr.decode().strip()}\n")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Typing is implemented by replacing the global clipboard and pasting, which silently destroys the user's existing clipboard contents and may leak sensitive data if the clipboard is monitored or later pasted elsewhere. In a GUI automation context this side effect is easy to miss and can affect unrelated applications and workflows.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mac_use.py (reported line 577)May include surrounding context.

python

if args.app:
        activate_and_find(args.app)

    proc = subprocess.Popen(["pbcopy"], stdin=subprocess.PIPE)
    proc.communicate(args.text.encode("utf-8"))

    keystroke_via_osascript("v", ["command"])

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a lower bound only, which permits installation of any future release and prevents reproducible builds. This increases supply-chain risk because a compromised or breaking upstream release could be pulled in unexpectedly, though the requirement alone is not evidence of active exploitation.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

pyobjc-framework-Vision>=12.0
pyautogui>=0.9
Pillow>=10.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Using an unpinned version for pyautogui creates a supply-chain and reproducibility weakness by allowing arbitrary newer releases to be installed. In this skill's context, pyautogui directly automates GUI input, so a malicious or compromised upstream release would have powerful interaction capability on the host desktop.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

pyobjc-framework-Vision>=12.0
pyautogui>=0.9
Pillow>=10.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

Pillow is unpinned, so installs are non-deterministic and may resolve to vulnerable or compromised releases. Because this skill processes screenshots and images, Pillow is part of the active data path, making dependency integrity and version control more important than in an unused transitive package.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

pyobjc-framework-Vision>=12.0
pyautogui>=0.9
Pillow>=10.0

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The manifest does not pin Pillow, and Pillow has multiple published advisories, so the installed version could be affected without any way to verify from this file alone. In a GUI automation skill that captures and handles screenshots, a vulnerable imaging library increases risk of code execution or denial of service through crafted image inputs or unsafe parsing paths.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Vision text recognition request forces recognition languages to zh-Hans and en only. This imposes a language/locale constraint without offering user opt-in or documenting why the tool is limited to those languages, which matches the policy's language-choice concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.