ClawHub
Back to skill

Security audit

openclaw-computer

Security checks for vulnerabilities and agentic risk

Overview

This desktop-control skill is broadly coherent, but it can delete files, capture screens, type into apps, launch commands, and kill processes while its documented safety controls are not actually enforced.

Install only if you are comfortable giving this skill broad control over your desktop session and user files. Treat screen capture, screen recording, keyboard input, application launch, file deletion, and process killing as sensitive actions; use a constrained test account or VM, avoid running it with elevated privileges, avoid xhost +local:, and do not rely on the documented sandbox or confirmation claims unless the implementation is changed to enforce them.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
computer_use.py:235
Finding

Documented sandbox and authorization controls are not enforced

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:98
Finding

Python dependencies are installed without version or integrity pinning

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:484
Finding

Troubleshooting guidance grants broad local access to the X server

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (105)

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding

This mismatch is security-relevant because the skill description understates destructive and surveillance-capable actions such as file deletion, renaming, process termination, and clipboard extraction. Users or orchestrators may invoke the skill believing it only performs benign visual management, when it can actually alter the filesystem and terminate processes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding

This mismatch is security-relevant because the skill description understates destructive and surveillance-capable actions such as file deletion, renaming, process termination, and clipboard extraction. Users or orchestrators may invoke the skill believing it only performs benign visual management, when it can actually alter the filesystem and terminate processes.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This mismatch is security-relevant because the skill description understates destructive and surveillance-capable actions such as file deletion, renaming, process termination, and clipboard extraction. Users or orchestrators may invoke the skill believing it only performs benign visual management, when it can actually alter the filesystem and terminate processes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The launch handler accepts a value documented as an application name but executes it directly via $name &, which allows arbitrary shell command execution rather than constrained app launching. In a computer-control skill, this is especially dangerous because an upstream agent or user prompt can turn 'launch app' into execution of any program or shell payload with the current user's privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Copy, move, and especially delete operations can irreversibly alter user data, yet they occur with no confirmation, safety checks, or sandboxing. In a computer-control skill, unrestricted file mutation is highly dangerous because it enables destructive actions and data loss on the host filesystem.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README advertises GUI automation, file management, screenshot/recording, application control, and process management without any guidance about user consent, confirmation prompts, scope limits, or handling of sensitive data. In a computer-control skill, these capabilities directly enable destructive actions and privacy-invasive collection, so omission of safeguards materially increases the risk of misuse or unsafe deployment.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 27)May include surrounding context.

bash
# Ubuntu/Debian
sudo apt-get install -y scrot xdotool wmctrl xclip ffmpeg

# macOS
brew install imagemagick cliclick ffmpeg

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

bash
# Ubuntu/Debian
sudo apt-get install -y scrot xdotool wmctrl xclip ffmpeg

# macOS
brew install imagemagick cliclick ffmpeg

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

bash
# Ubuntu/Debian
sudo apt-get install -y scrot xdotool wmctrl xclip ffmpeg

# macOS
brew install imagemagick cliclick ffmpeg

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 480)May include surrounding context.

bash
# Ubuntu/Debian
sudo apt-get install -y scrot xdotool wmctrl xclip ffmpeg

# macOS
brew install imagemagick cliclick ffmpeg

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill advertises broad computer-control behavior and includes examples that imply shell, file read, and file write capabilities, but it does not declare any explicit tool scope or permission boundaries. For a desktop-control skill, missing scope is dangerous because it can silently expand into filesystem manipulation and command execution without policy enforcement or user visibility.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The main heading and introductory marketing text are presented in Chinese, and the rest of the skill documentation continues primarily in Chinese despite the manifest metadata being in English. This creates a language/locale constraint without any explicit user choice or justification, which matches the policy category for forced language without opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill promises confirmation before sensitive actions, but the documented commands perform destructive operations directly with no visible approval workflow. This creates a deceptive safety model where users may believe deletes or kills require consent when they may execute immediately.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation claims sandboxing and protection of critical files, yet the examples show system-wide file and process operations with no demonstrated enforcement. That discrepancy can cause operators to trust the skill in sensitive environments, leading to unrestricted deletion, movement, process control, or data exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description says the skill can record the screen and schedule system tasks, and the help output also advertises computer-record. However, this script only dispatches screenshot, mouse, keyboard, app, file, and monitor commands, with no recording or scheduling implementation present.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The keyboard function sends arbitrary keystrokes to the active window with no confirmation, preview, target validation, or safety boundary. In a GUI automation skill, this can cause unintended commands, credential entry into the wrong window, destructive actions, or social-engineering style abuse if invoked by an untrusted agent workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Launching a user-supplied command without warning or confirmation is unsafe in a desktop-control skill because it can immediately execute arbitrary local programs and chained shell commands. The skill context makes this more dangerous, not less, since the stated purpose is to automate system interaction and users may assume 'app launch' is a constrained action rather than arbitrary execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Full-screen and window screenshot capture occur without any user-facing notice or confirmation, enabling silent collection of sensitive on-screen information. In a computer-use skill, that context makes the issue more dangerous because screen content often includes credentials, personal messages, and confidential documents.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
87% confidence
Finding

Full-screen screenshots can capture secrets, credentials, personal data, tokens, and other sensitive content from any visible application. The method performs this capture without any user-facing warning, scope restriction, or consent check, which is risky in a computer-control skill.

Content

Scanner excerpt · computer_use.py (reported line 30)May include surrounding context.

python
# 尝试不同的截图工具
        if self._command_exists("scrot"):
            subprocess.run(["scrot", save_path], check=True)
        elif self._command_exists("gnome-screenshot"):
            subprocess.run(["gnome-screenshot", "-f", save_path], check=True)
        elif self._command_exists("import"):  # ImageMagick

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
87% confidence
Finding

Like the scrot-based path, this captures the entire screen and may collect secrets or private data from unrelated applications. The lack of consent, visibility, and capture scoping makes it risky in a general-purpose computer-control skill.

Content

Scanner excerpt · computer_use.py (reported line 32)May include surrounding context.

python
if self._command_exists("scrot"):
            subprocess.run(["scrot", save_path], check=True)
        elif self._command_exists("gnome-screenshot"):
            subprocess.run(["gnome-screenshot", "-f", save_path], check=True)
        elif self._command_exists("import"):  # ImageMagick
            subprocess.run(["import", "-window", "root", save_path], check=True)
        else:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
87% confidence
Finding

This alternate full-screen capture path has the same privacy risk as the other screenshot implementations: it silently captures everything visible on the desktop. In this skill context, unrestricted screenshotting is sensitive because it enables collection of user data across applications.

Content

Scanner excerpt · computer_use.py (reported line 34)May include surrounding context.

python
elif self._command_exists("gnome-screenshot"):
            subprocess.run(["gnome-screenshot", "-f", save_path], check=True)
        elif self._command_exists("import"):  # ImageMagick
            subprocess.run(["import", "-window", "root", save_path], check=True)
        else:
            raise RuntimeError("未找到截图工具，请安装 scrot 或 ImageMagick")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · computer_use.py (reported line 50)May include surrounding context.

python
if self._command_exists("scrot"):
            # 使用 scrot 的选区模式
            subprocess.run(["scrot", "-s", save_path], check=True)
        else:
            raise RuntimeError("区域截图需要 scrot")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
86% confidence
Finding

Window capture can expose sensitive contents from the active or targeted window without any confirmation or visibility to the user. In a desktop-control skill, silent collection of application contents materially increases privacy and data-exfiltration risk.

Content

Scanner excerpt · computer_use.py (reported line 64)May include surrounding context.

python
save_path = os.path.join(self.save_dir, filename)
        
        if self._command_exists("scrot"):
            subprocess.run(["scrot", "-u", save_path], check=True)
        else:
            raise RuntimeError("窗口截图需要 scrot")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · computer_use.py (reported line 72)May include surrounding context.

python
@staticmethod
    def _command_exists(cmd: str) -> bool:
        return subprocess.run(["which", cmd], 
                            capture_output=True).returncode == 0

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · computer_use_pro.py (reported line 143)May include surrounding context.

python
@staticmethod
    def _command_exists(cmd: str) -> bool:
        return subprocess.run(["which", cmd], 
                            capture_output=True).returncode == 0