ClawHub
Back to skill

Security audit

PeekabooV3 open claw的桌面自动化skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for macOS GUI automation, but it can install a third-party desktop-control tool without a fresh user confirmation and then operate with high-impact screen and accessibility access.

Review before installing. This skill is not showing exfiltration or persistence, but it can add software to your Mac and drive local apps after Screen Recording and Accessibility permissions are granted. Prefer requiring explicit approval for the exact Homebrew install command and use it only for specific desktop tasks you initiate.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/install_if_needed.sh:10
Finding

Automatic Installation of an Unpinned Third-Party Homebrew Dependency

Content
View full analysis

Vulnerability Details

File Location: scripts/install_if_needed.sh:10-19
Related Instruction Locations: SKILL.md:26-32, SKILL.md:146
Vulnerability Type: Supply-chain risk from an automatically installed, mutable third-party dependency
Risk Level: Medium

Vulnerable Code

bash
if ! command -v brew >/dev/null 2>&1; then
  echo "STATUS=brew-missing"
  exit 2
fi

brew install steipete/tap/peekaboo

echo "STATUS=installed-now"
command -v peekaboo
peekaboo --version || true

The corresponding skill instructions state:

bash
If `peekaboo` is missing, install it proactively:

brew install steipete/tap/peekaboo

They also explicitly instruct the agent not to request approval before this installation when Homebrew is available.

Technical Analysis

The installation command obtains Peekaboo from the third-party Homebrew tap steipete/tap. It does not pin the dependency to a reviewed version, immutable source revision, or cryptographic digest. It also does not independently verify an artifact signature or checksum before installation.

As a result, the effective code installed and executed can change after this skill package has been audited. Homebrew formula installation may download artifacts and execute formula-defined installation logic. If the tap, its publishing account, the formula, or an upstream release is compromised, the skill could install attacker-controlled code while appearing to perform its documented setup workflow.

This finding does not establish that the current Peekaboo package or tap is malicious. It identifies an avoidable supply-chain trust risk caused by automatic installation from a mutable external source without integrity pinning.

Attack Path

  1. A user requests Peekaboo setup or native macOS automation.
  2. The skill checks the local environment and finds that peekaboo is absent.
  3. Homebrew is present, so the workflow does not ask the user to approve the package installation.
  4. `brew inst ...[truncated 1269 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit user approval before installing any third-party package, even when Homebrew is already installed.
  2. Pin Peekaboo to a specifically reviewed release and, where practical, an immutable source or formula revision.
  3. Verify downloaded artifacts using a trusted cryptographic signature or a hardcoded checksum obtained through an independent trusted channel.
  4. Record and report the exact package version and source revision before installation.
  5. Separate dependency acquisition from execution so users can inspect and approve the resolved package metadata.
  6. After installation, verify that command -v peekaboo resolves to the expected Homebrew-managed path and validate the installed version before invoking it.
  7. Document the third-party trust boundary and advise users that Screen Recording and Accessibility authorization should only be granted after the installed binary has been verified.
  8. Consider distributing a reviewed, version-locked dependency manifest rather than resolving the latest state of a mutable tap at runtime.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The description presents a broad automation skill and explicitly claims it will detect a missing Peekaboo installation and proactively install it. The actual code chunk is limited to a presence/version check for the peekaboo binary. While installation detection is aligned, the claimed installation behavior is absent, and none of the core advertised capabilities—GUI automation, screen understanding, or controlling macOS apps—are implemented in this code. This is a material description-to-behavior mismatch rather than a mere supporting utility detail.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents a broad desktop automation capability for macOS, including controlling apps and installing Peekaboo if necessary. The actual code chunk is a single shell command that checks Peekaboo permissions status. While permission checking could be a supporting step for such a tool, this code by itself does not implement the stated primary functionality and omits a key declared behavior (proactive installation if missing). Therefore the supplied code chunk does not accurately represent the declared purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description uses very broad activation criteria, covering nearly any macOS native-app inspection or control task. That increases the chance the skill is invoked in situations involving sensitive apps, private data, or high-impact actions without sufficiently narrow scoping.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill authorizes proactive installation of third-party software (Peekaboo) when missing, without requiring an explicit confirmation at the point of installation if Homebrew is already present. Automatic package installation changes the local system state and can introduce supply-chain, trust, and policy risks, especially in enterprise or locked-down environments.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The instruction to 'not ask before installing Peekaboo itself' delegates a system-modifying decision to the agent without contemporaneous user approval. In the context of a desktop automation skill that also requests Accessibility and Screen Recording permissions, this materially raises the risk of unexpected software deployment and expanded local control.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md
- bulk actions that could affect user data
- installing Homebrew if it is not present

Do not ask before installing Peekaboo itself if Homebrew is already available and the user asked to use or set up Peekaboo.

## Troubleshooting

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script automatically installs a Homebrew package from a third-party tap when peekaboo is missing, without any user-facing confirmation or trust prompt. In the context of an agent skill that may proactively install missing software, this increases risk because it can modify the host system and introduce unreviewed code execution through package formulas controlled outside the base system.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.