Mac Use 1.0.0

• Outcome: Review
• Latest audit: May 29, 2026 · 9:24 PM UTC
• Version: 1.0.0

Overview

This skill does what it says, but it gives an agent broad screen-reading and Mac GUI-control power with weak containment around sensitive actions and temporary data.

Install only if you are comfortable granting the OpenClaw host process macOS Screen Recording and Accessibility access. Use it for supervised, bounded tasks; avoid password managers, banking, admin settings, private messages, payment flows, deletion flows, and public posting unless you explicitly confirm each step. Clear /tmp/mac_use*.png, /tmp/mac_use_elements.json, and the clipboard after sensitive sessions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def activate_app(app_name):
    """Bring an app to the foreground."""
    subprocess.run(
        ["osascript", "-e", f'tell application "{app_name}" to activate'],
        capture_output=True,
        timeout=5,

• Confidence: 98% confidence
• Finding: This call builds AppleScript code by directly interpolating the untrusted app_name into a quoted script string. An attacker who can influence the app name argument can break out of the string and inject arbitrary AppleScript commands, which may control apps, read data, or trigger further system actions under the user's automation permissions.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

else:
        mod_str = ""
    script = f'tell application "System Events" to keystroke "{key}"{mod_str}'
    r = subprocess.run(["osascript", "-e", script], capture_output=True, timeout=10)
    if r.returncode != 0:
        sys.stderr.write(f"osascript keystroke failed: {r.stderr.decode().strip()}\n")

• Confidence: 98% confidence
• Finding: The script passed to osascript is assembled from user-influenced key and modifier values without escaping the keystroke literal. A crafted key value containing quotes or AppleScript syntax can inject additional statements and execute arbitrary AppleScript actions with the tool's accessibility permissions.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

f'to perform action "AXRaise" of window "{safe_title}"'
    )
    try:
        subprocess.run(["osascript", "-e", script], capture_output=True, timeout=5)
        time.sleep(0.3)
    except Exception:
        pass

• Confidence: 97% confidence
• Finding: Although the window title has quote and backslash escaping, the app_name portion is still interpolated into AppleScript without sanitization. An attacker controlling the app parameter can inject arbitrary AppleScript into the System Events command used to raise windows, leading to unintended GUI automation or other privileged actions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill invokes shell commands, installs packages, writes artifacts to /tmp, and automates arbitrary GUI interaction, but it does not declare permissions corresponding to those capabilities. That creates a trust and policy gap: users or the host platform may not realize the skill can execute commands and capture/write sensitive screen data, increasing the chance of unsafe deployment or misuse.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This skill is specifically designed to capture screenshots of arbitrary macOS application windows, and those screenshots may contain passwords, messages, tokens, financial data, or other sensitive on-screen content. Failing to prominently warn about that risk can lead users to expose confidential data unintentionally, especially because the workflow instructs repeated screenshots and saving annotated images to predictable temporary paths.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The tool writes arbitrary text to the system clipboard and pastes it into the active application without any confirmation, disclosure, or restoration of prior clipboard contents. In a GUI automation skill, this is more dangerous because the active target may be a password manager, terminal, chat app, or production console, causing accidental secret leakage, destructive commands, or silent clipboard theft/overwrite.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The helper captures a full-screen screenshot and stores it in predictable files under /tmp before cropping to the target window. In this skill context, that can unintentionally collect unrelated apps, notifications, credentials, or personal data and expose them to other local processes or later reads if temporary files are reused or left behind.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pyobjc-framework-Vision>=12.0
pyautogui>=0.9
Pillow>=10.0

• Confidence: 94% confidence
• Finding: The dependency is specified with only a lower bound, which allows future unreviewed versions to be installed and can lead to non-reproducible builds or accidental inclusion of vulnerable releases. In a GUI automation skill, supply-chain risk matters because the package directly influences desktop interaction capabilities.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pyobjc-framework-Vision>=12.0
pyautogui>=0.9
Pillow>=10.0

• Confidence: 95% confidence
• Finding: The unpinned pyautogui dependency permits installation of arbitrary newer versions, increasing supply-chain and reproducibility risk. This is more concerning here because pyautogui can control mouse and keyboard input on macOS, so a compromised or unsafe version could directly affect the user's desktop session.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pyobjc-framework-Vision>=12.0
pyautogui>=0.9
Pillow>=10.0

• Confidence: 93% confidence
• Finding: Using Pillow with only a minimum version leaves builds exposed to dependency drift and may allow installation of versions with known or newly introduced security issues. Because this skill likely processes screenshots or images, image-parsing libraries are part of the attack surface and deserve stricter version control.

Known Vulnerable Dependency: Pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The requirement allows Pillow versions at or above 10.0, and static analysis indicates multiple known advisories affect Pillow versions in that range or potentially selectable by this constraint. In this skill context, Pillow is likely used for screenshots or image handling, so malicious image input or crafted screen content could trigger denial of service or worse if a vulnerable version is installed.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.