Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed macOS desktop-control guidance skill with a local installer script, not evidence of hidden or malicious behavior.
Install this only if you intentionally want OpenClaw to use macOS desktop automation with screen, accessibility, clipboard, app-control, and shell-capable MCP tools. Review the installer first if you have customized copies of this skill in OpenClaw workspaces, because rerunning it replaces that skill's existing directories.
声明描述的是一个面向用户的桌面控制技能：何时触发、如何正确使用 desktop-control MCP、如何阅读状态与调用工具。但实际代码块只是一个 shell 安装脚本，作用是把该技能部署到 OpenClaw 的多个 workspace 中。两者主目的明显不同：声明强调桌面自动化能力与触发语义，代码则只做本地文件安装与目录维护。代码访问的资源也是本地文件系统与 OpenClaw 状态目录，而非桌面控制接口。因此这属于明显的描述与行为不一致。
The trigger phrases include very broad natural-language requests like '控制电脑', '帮我点', and '帮我截屏', which can match routine user requests and cause unintended activation. Because this skill controls the desktop and can interact with apps, accidental invocation materially increases the risk of unauthorized or surprising actions on the user's machine.
The alias list contains generic terms such as '控制电脑', '自动化 macOS', '帮我点', and '看下屏幕', which are common requests rather than unique skill names. For a skill with desktop control and screenshot capability, vague aliases make unintentional activation significantly more dangerous than in a read-only or low-impact skill.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
| `click` 完接着 `type`，没验证按钮按下生效 | act tool 全部加 `expect_after` |
| 看到 `[state]` 里 `screenshot=120s ago` 还在用旧坐标 | 先调 `screenshot` 重置截图新鲜度 |
| 用 `screenshot` + 像素识别去找按钮位置 | 优先 `find_element` 按 role/title 直接拿到中心坐标 |
| `run_command` 跑 `rm -rf` / `curl \| sh` | 桌控 guardrail 直接拒；让用户自己跑 |
| 多步操作之间不调 `get_state` 检查健康 | 每 5-10 步调一次 `get_state` 确认会话状态 |
---
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# 清掉错位置残留（outer/<slug>/，单层）
if [[ -e "$outer/$SKILL_NAME" && "$outer/$SKILL_NAME" != "$inner" ]]; then
rm -rf "$outer/$SKILL_NAME"
echo " 🗑 cleared stale: $outer/$SKILL_NAME"
fi
The skill explicitly documents a shell-capable tool (run_command) but does not declare any tool scope such as permissions or allowed-tools. In a desktop automation skill, undeclared shell capability broadens the attack surface and can enable unintended command execution if the agent invokes tools beyond the user's expectation.
The activation description uses an open-ended '任何' formulation for requests involving mouse, keyboard, screen viewing, or app control, without boundaries or confirmation gates. This ambiguity encourages over-activation and is particularly risky in a skill that can directly manipulate the user's desktop session.
Comments and user-facing output, including the final trigger test guidance, are written in Chinese only. This creates a language/locale policy concern because the skill does not offer an alternative language or indicate that the locale restriction is intentional and limited to a specific audience.
The script unconditionally runs rm -rf on both a stale outer skill path and the target install directory before copying files. While it prints messages after deletion, there is no prior user confirmation or explicit warning in comments/docstrings that existing workspace content will be removed and replaced.
No suspicious patterns detected.