Security audit

Screen Activity Tracker

Security checks for vulnerabilities and agentic risk

Overview

This screen-tracking skill does what it claims at a high level, but it records full-screen activity in the background and has under-disclosed privacy and data-transfer risks.

Review this carefully before installing. Only use it if you are comfortable with background full-screen screenshots, searchable local history, and sending screenshots to the configured MLX service for analysis. Change mlx_url to a trusted local endpoint or disable remote analysis, verify that sensitive apps are actually excluded because the blacklist code is currently commented out, protect config.json because it may contain a SiYuan token, and confirm the cron job and retention settings are easy for you to stop and purge.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (23)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: ss_dir = os.path.join(output_dir, "screenshots") if os.path.exists(ss_dir): try: subprocess.run( ["find", ss_dir, "-type", "d", "-mtime", f"+{keep_days}", "-exec", "rm", "-rf", "{}", "+"], capture_output=True, timeout=30, )
Confidence: 83% confidence
Finding: The code performs destructive deletion by spawning find with -exec rm -rf against a configurable output directory. Although it does not use a shell and is not command-injection prone, an unsafe or manipulated output_dir/keep_days configuration can cause unintended recursive deletion of directories under an attacker-chosen path, leading to data loss.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill manifest advertises behavior around tracking and summaries, but it does not declare permissions despite clearly requiring shell execution, file writes, and network access. This weakens informed consent and reviewability, making it easier for a privacy-invasive skill to be installed or invoked without users understanding its true capabilities.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The stated purpose is framed narrowly as screen activity tracking and summaries, but the documented behavior includes full-screen capture, remote/local HTTP analysis of screenshot content, and writing data into SiYuan over the network. That mismatch is dangerous because it conceals materially more sensitive data collection and transmission than a user would reasonably expect from the description alone.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest description omits that captured screen content may be sent over HTTP to an analysis service and that logs may be written to SiYuan via network APIs. Because screenshots can contain credentials, private messages, and confidential documents, hiding this data flow materially increases privacy and exfiltration risk.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill’s design allows periodic capture of screen-derived data and transmission to analysis/storage endpoints, which creates a real exfiltration path for highly sensitive information. In the context of a background cron job, this is more dangerous because collection is recurring and can happen without a fresh per-capture confirmation from the user.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The file advertises activity tracking, summary, and search, but it also includes screenshot content analysis that reads an image file, base64-encodes it, and submits the full contents to an external ML API. In a screen-activity skill, screenshots can contain highly sensitive material such as messages, credentials, documents, or financial data, so this undeclared capability materially expands data exposure beyond the stated purpose.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code performs an outbound HTTP POST to a configurable ML endpoint and uploads the entire screenshot as a data URL. This creates a direct exfiltration path for sensitive on-screen information, and the skill context makes it more dangerous because a screen-activity tool is likely to process screenshots of everyday user activity containing private content.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script captures full-screen screenshots and performs vision-model analysis on them, which is materially more sensitive than a generic 'screen activity tracking' description implies. Screens may contain passwords, messages, documents, or other sensitive content, so undisclosed image capture and AI processing creates a meaningful privacy and data-handling risk.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The configuration supports sending screenshot-derived content to a configured HTTP endpoint via MLX_URL, but this outbound transmission is not clearly disclosed by the skill description. If the endpoint is remote or user-misconfigured, highly sensitive screen contents may be exfiltrated off-device without informed consent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README markets the tool as convenient and privacy-friendly, but it does not prominently warn users up front that it performs continuous screenshot capture of their screen contents. Because screenshots can include messages, tokens, documents, credentials, and other sensitive data, insufficient disclosure can lead users to enable persistent surveillance without informed consent.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The documentation mentions use of an OpenAI-compatible vision model and references a remote MLX service endpoint, but it does not clearly warn that using a remote backend may send screenshot contents off-device to another server. In this skill's context, the screenshots may contain highly sensitive personal or corporate data, so omission of data-transmission disclosure creates substantial privacy and compliance risk.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The README enthusiastically promotes continuous screenshot capture and AI analysis but does not present a prominent, explicit warning that the tool may record sensitive on-screen content such as messages, documents, credentials, or regulated data. Because the skill operates continuously and archives activity over time, users may enable it without understanding the scope of collection, increasing the chance of privacy harm, accidental retention of secrets, or inappropriate use on sensitive systems.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README describes local storage and searchable history as features, but it does not clearly warn that screenshots and AI-generated activity logs are retained in a browsable timeline that can expose historical screen contents long after they were shown. Even if data remains local, this creates meaningful privacy and security risk if the device is shared, compromised, backed up insecurely, or searched by other local software.

Missing User Warnings

High

Confidence: 96% confidence
Finding: A skill that periodically captures screenshots and logs user activity/history is highly privacy-sensitive, yet the description around usage does not present a clear warning at the point of activation. Users may trigger background surveillance-like behavior without understanding that their screen contents and workflow history are being continuously recorded.

Missing User Warnings

High

Confidence: 93% confidence
Finding: The configuration example shows screenshot-derived activity data being sent to network services, including a SiYuan endpoint and an MLX analysis URL, without any nearby warning about sensitivity, trust boundaries, or retention. This normalizes insecure deployment and increases the chance that users forward confidential screen contents to services they have not properly vetted.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Screenshot contents are sent to a remote service without any user-facing warning, consent flow, or disclosure in the skill behavior. Because screenshots may capture sensitive personal or business data, silent transmission undermines user expectations and privacy, especially in a tool presented primarily as a tracker/summarizer/search utility.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The script captures screenshots and transmits their contents for analysis without any runtime warning, consent prompt, or visible indicator. Silent collection and processing of screen contents is especially risky because screens routinely expose credentials, personal communications, financial information, and proprietary work product.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script writes screenshots and activity logs to disk in a predictable location under the user's home directory without clear disclosure. Persistent local storage increases exposure if the device is shared, backed up to third parties, or later compromised, since historical screenshots can reveal extensive sensitive activity.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This skill persistently stores activity summaries and references to screenshots in local markdown files under a user directory without any runtime consent, visibility, or warning in the code path. Because the skill's purpose is screen activity tracking, the data is likely to contain sensitive user behavior, app usage, or visible on-screen content, raising meaningful privacy risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: When the SiYuan backend is enabled, screenshots and summaries are uploaded to an HTTP API with no explicit consent flow or trust validation in this file. In the context of a screen-tracking skill, this materially increases risk because highly sensitive screenshots may be transmitted off-process or off-device depending on configuration.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The cleanup routine silently deletes old screenshot directories based on configuration, without any user-facing notice or confirmation. In a logging skill that collects potentially sensitive records, silent destruction is risky because it can remove evidence, surprise users, or amplify damage if the configured path is wrong.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The setup wizard prompts the user for a SiYuan API token and writes it directly into config.json without any warning about sensitivity, storage location, or file permissions. In the context of a screen-tracking skill that may run unattended via cron, this creates a realistic risk that local users, backups, logs, or accidental file sharing could expose the token and enable unauthorized access to the user's SiYuan instance.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: # ========== Cleanup old screenshots ========== if [ "$KEEP_DAYS" -gt 0 ] 2>/dev/null; then find "$OUTPUT_DIR/screenshots" -type d -mtime +$KEEP_DAYS -exec rm -rf {} + 2>/dev/null || true # Also clean up empty date md files if using local backend fi
Confidence: 78% confidence
Finding: The cleanup logic performs `find ... -exec rm -rf {} +` using a path derived from configuration. Although the path is quoted and constrained to a screenshots subdirectory, destructive recursive deletion driven by user-controlled configuration remains risky if OUTPUT_DIR is misconfigured, points to unexpected locations, or if symlink/path-layout issues arise.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: config.example.json:8