HiDPI Mouse

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:55 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its mouse-automation purpose, but it needs review because unsafe input handling and shared temporary files could misdirect clicks or enable command execution in some uses.

Review before installing. Only use this in a desktop session where you are comfortable with an agent moving and clicking the mouse, avoid sensitive prompts or financial/account screens, and pass only plain numeric coordinates. The scripts should be hardened with coordinate validation and private per-user cache/temp paths before relying on them in multi-user or untrusted-content environments.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/reliable_click.sh:27

Finding

Command Execution Through Unvalidated Bash Arithmetic Expressions

Content

View full analysis

Remediation

View remediation

&2 exit 1 fi ``` Apply the same validation to `WIN_X` and `WIN_Y` after parsing `xdotool` output: ```bash if ! is_integer "$WIN_X" || ! is_integer "$WIN_Y"; then echo "Error: Invalid window geometry" >&2 exit 1 fi ``` Additional hardening should include: 1. Require exactly one argument after `--window` and reject a missing value. 2. Reject unexpected trailing positional arguments. 3. Add reasonable coordinate bounds based on the active screen or target-window geometry. 4. Use `printf '%d'` only after strict validation; formatting alone should not replace validation. 5. Add regression tests using nonnumeric values, arithmetic operators, variable names, array syntax, and command-substitution-like input. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/detect-scale.sh:14

Finding

Predictable Shared Temporary Files Allow Cache Poisoning and File Clobbering

Content

View full analysis

/dev/null || echo 0))) if [[ $CACHE_AGE -lt 3600 ]]; then cat "$CACHE_FILE" exit 0 fi fi ... # Cache result mkdir -p "$(dirname "$CACHE_FILE")" 2>/dev/null || true echo "$SCALE" > "$CACHE_FILE" ``` From `scripts/calibrate.sh`: ```bash CONFIG_DIR="$HOME/.config/hidpi-mouse" CONFIG_FILE="$CONFIG_DIR/scale.conf" CACHE_FILE="/tmp/hidpi_scale_cache" ... CAL_IMG="/tmp/hidpi_calibration.png" ... img.save('$CAL_IMG') ``` The same cache is also removed without ownership or file-type verification: ```bash rm -f "$CACHE_FILE" ``` ### Technical Analysis The scripts use fixed, globally predictable paths under the shared `/tmp` directory: - `/tmp/hidpi_scale_cache` - `/tmp/hidpi_calibration.png` The scale cache is trusted based only on its existence and modification time. Its ownership, permissions, file type, and contents are not validated before the value is returned to `click.sh`, `move.sh`, or `drag.sh`. Because `/tmp` is normally writable by all local users, another local process may create the cache first or replace it between checks. A forged fresh scale can influence the coordinates used for subsequent GUI automation. The scripts also overwrite predictable paths without secure file creation or explicit symbolic-link rejection. Depending on operating-system temporary-file protections, filesystem configuration, and target ownership, a malicious symbolic link may redirect an output operation to another file writable by the vi ...[truncated 1895 chars]

Remediation

View remediation

"$tmp" chmod 600 "$tmp" mv -fT -- "$tmp" "$CACHE_FILE" ``` 6. Avoid separate check-and-read operations where possible. Open and validate the same file object or use an implementation with safe file-descriptor handling if hostile local concurrency is in scope. 7. Ensure cleanup only removes files inside the private runtime directory and does not follow attacker-controlled path components. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description emphasizes mouse click handling and mentions auto-detection or calibration for any screen resolution/DPI. The provided code only implements mouse movement (xdotool mousemove) with optional raw mode and scale-factor adjustment via detect-scale.sh or HIDPI_SCALE. It does not perform clicking, and there is no calibration logic in this code chunk. While the HiDPI coordinate conversion aspect is consistent, the primary stated purpose is broader and materially different from the actual behavior shown.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The code does perform Linux desktop mouse clicking with coordinate handling, so it is related to the declared area. However, the specific claimed purpose is not accurately represented. The description emphasizes universal HiDPI handling, automatic scale-factor detection or calibration, and conversion from Claude display coordinates to xdotool coordinates. This script does not detect DPI, scale factor, or perform any calibration logic. It simply accepts coordinates as provided and, if requested, adds window position offsets to convert relative window coordinates into absolute screen coordinates. Additionally, it includes undeclared behavior to search for a window by name, choose a window candidate, activate it, and click within it. Those are meaningful capabilities beyond the stated description. Therefore the description materially overstates HiDPI/conversion behavior and omits notable window-management behavior.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

Reset everything

bash

./scripts/calibrate.sh reset
rm -f /tmp/hidpi_scale_cache

📁 Configuration Files

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation encourages click, move, and drag automation without warning that these actions can modify files, submit forms, approve prompts, or trigger destructive UI actions. In a desktop automation context, missing safety guidance increases the chance of accidental misuse against user data or system state, especially when coordinates may be imperfect due to scaling issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The example workflow instructs users to capture a screenshot into /tmp but omits any privacy warning that screenshots may contain credentials, personal data, internal documents, or other sensitive information. On multi-user or less isolated environments, writing such images to predictable temporary locations can increase exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The reset operation removes both the persistent config file and cache file immediately via rm -f. Although the script prints a message afterward, there is no pre-action confirmation prompt or warning at the point of execution for this destructive state-clearing action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script writes a predictable cache file to /tmp using shell redirection without creating it securely. On multi-user systems, another local user could pre-create /tmp/hidpi_scale_cache as a symlink or replace its contents, causing stale or attacker-controlled scale values to be read, or potentially redirecting writes to another file accessible to the script's user. In this skill's context the value is only a numeric scale factor, so impact is limited to integrity/availability issues in automation rather than direct code execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This shell script includes its descriptive comments and usage/help output primarily in Chinese, such as the script description and option explanations. Under the language/locale policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.