ClawHub
Back to skill

Security audit

Gui Tool

Security checks for vulnerabilities and agentic risk

Overview

This is a plainly documented desktop automation skill with powerful but expected screenshot, window, mouse, and keyboard controls.

Install only if you want an agent to inspect and control your live desktop. Supervise use around private windows, passwords, financial or administrative actions, and irreversible form submissions.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill description is broadly scoped to 'automate any GUI interaction' and invites use whenever the agent needs to click, type, or interact with applications. That expansive trigger language can cause an agent to invoke a highly privileged desktop-control capability in situations involving sensitive data, destructive actions, or user workflows without sufficient narrowing, confirmation, or safety checks.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This skill enables screenshots, window enumeration, window focus changes, mouse clicks, and keyboard input, all of which can expose private on-screen information or alter system/application state. Because the markdown lacks any warning about privacy, sensitive content capture, or the risk of unintended destructive GUI actions, an agent may use it in contexts where users do not realize the data-access and system-impact implications.

Static analysis

No suspicious patterns detected.