windows-control

ISSUES FOUND max severity CRITICALSkillSpector Caution 0 registry clawhub.ai last scanned 2026-02-07 1 scan

5 findings (2 critical, 2 high, 1 medium), mainly data exfiltration, command injection, resource abuse. Most recent scan 2026-02-07.

CRITICAL SECURITY RISK - This skill provides unrestricted desktop automation capabilities that pose severe security threats. The skill grants complete control over the Windows desktop including screenshot capture, window content extraction, keyboard/mouse control, and dialog manipulation without any safeguards, user confirmation requirements, or access restrictions. The combination of capabilities enables multiple attack vectors: (1) automated data exfiltration through screenshots and window reading, (2) credential theft from browsers and applications, (3) security control bypass through automated dialog dismissal, (4) arbitrary command execution via GUI automation, and (5) browser session hijacking. The skill's benign description significantly understates these risks. The lack of input validation, sandboxing, or operation logging makes this skill a powerful tool for malicious actors. The missing allowed-tools declaration prevents enforcement of tool restrictions. This skill should NOT be used in production environments without major security enhancements including user confirmation prompts, operation allowlists, input validation, audit logging, and restricted access to security-critical UI elements.
Scanner's overall assessment (LLM analyzer)

Findings5

Critical2

High2

Medium1

Low0

Analyzersstatic llm meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 0

Score0 / 100

Issues0

Version2.12.0 (static)

SkillSpector found no issues but could not fully inspect the package, usually because SKILL.md refers to a file that is not present, so it fails closed to CAUTION instead of SAFE. Read it as "not fully checked", not as a finding. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Full Windows desktop control. Mouse, keyboard, screenshots - interact with any Windows application like a human.

Package: 25 files, 59 KB
SKILL.md: 1050 words, 12+ sections
Code: Python (23)

SKILL.md covers: Windows Control Skill · Quick Start · Screenshot · Click · Type Text · Press Keys · Move Mouse · Scroll · Window Management (NEW!) · Advanced Actions (NEW!) · Click by text (No coordinates needed!) · Drag and Drop

Findings

CRITICAL Unrestricted Desktop Control Enables Data Exfiltration Data Exfiltrationllm

This skill provides complete desktop automation capabilities (mouse, keyboard, screenshots, window control) without any restrictions or user confirmation requirements. An attacker could use these capabilities to exfiltrate sensitive data by: (1) taking screenshots of confidential information, (2) reading window contents from password managers or secure applications, (3) typing credentials into attacker-controlled applications, (4) automating file uploads to external services, or (5) extracting data from any visible application. The skill has no safeguards against automated data theft.

SKILL.md:1

Full desktop automation for Windows. Control mouse, keyboard, and screen like a human user. Includes screenshot.py (captures entire screen as base64), read_window.py (extracts text from any window), type_text.py (types arbitrary text), click.py (clicks anywhere), read_webpage.py (extracts browser content).

Remediation: (1) Add user confirmation prompts before sensitive operations (screenshots, reading windows, typing credentials). (2) Implement allowlists for which applications can be automated. (3) Add rate limiting to prevent bulk data extraction. (4) Require explicit user approval for each automation action. (5) Log all automation activities for audit trails. (6) Restrict screenshot capabilities to specific regions with user approval.

CRITICAL Arbitrary Command Execution via Unrestricted Python Scripts Command Injectionllm

The skill executes Python scripts with pyautogui, pywinauto, and other automation libraries without any input validation or sandboxing. Scripts accept user-controlled parameters (coordinates, text, window names) that are passed directly to system automation functions. An attacker could exploit this to: (1) execute arbitrary GUI automation sequences, (2) manipulate system dialogs and security prompts, (3) bypass security controls by automating clicks on 'Allow' buttons, (4) chain operations to perform complex attacks (e.g., open browser → navigate to malicious site → download file → execute), or (5) abuse handle_dialog.py to automatically dismiss security warnings.

scripts/type_text.py

Scripts accept raw command-line arguments without validation: type_text.py accepts arbitrary text to type, click.py accepts any coordinates, handle_dialog.py can click any dialog button including security prompts. Example: 'py handle_dialog.py click "Allow"' could bypass UAC or security warnings.

Remediation: (1) Implement strict input validation and sanitization for all script parameters. (2) Add allowlists for permitted window titles and application names. (3) Require user confirmation before interacting with system dialogs or security prompts. (4) Sandbox script execution with restricted permissions. (5) Implement operation logging and anomaly detection. (6) Add rate limiting to prevent automated attack chains.

HIGH Browser Content Extraction Enables Credential and Session Theft Data Exfiltrationllm

The read_webpage.py and read_ui_elements.py scripts can extract complete browser content including form fields, links, buttons, and text from any browser window. This capability could be exploited to: (1) steal credentials from login forms, (2) extract session tokens or API keys visible in browser developer tools, (3) capture sensitive data from banking or healthcare websites, (4) read private messages or emails from webmail interfaces, or (5) exfiltrate data from authenticated web applications. The scripts support all major browsers (Chrome, Firefox, Edge, Brave, Opera) and can extract structured data including clickable element coordinates.

scripts/read_webpage.py

read_webpage.py extracts full webpage content with --full flag including all elements. read_ui_elements.py returns structured data with element names, types, and coordinates. Both scripts can target any browser window and extract all visible content without user confirmation.

Remediation: (1) Require explicit user approval before reading browser content. (2) Implement blocklists for sensitive domains (banking, healthcare, authentication pages). (3) Redact or mask password fields and sensitive form inputs. (4) Add rate limiting to prevent bulk data extraction. (5) Log all browser content access for audit trails. (6) Warn users when browser automation is active.

HIGH Resource Exhaustion via Unbounded Automation Loops Resource Abusellm

Several scripts implement wait loops and retry mechanisms without proper bounds or timeouts. The wait_for_text.py and wait_for_window.py scripts poll continuously until conditions are met, potentially running indefinitely if conditions are never satisfied. An attacker could exploit this to: (1) cause CPU exhaustion through continuous polling, (2) create denial-of-service conditions by triggering multiple waiting scripts, (3) lock up the agent by waiting for impossible conditions, or (4) consume system resources through unbounded screenshot or window enumeration operations.

scripts/wait_for_text.py

wait_for_text.py and wait_for_window.py implement while loops with time.sleep(0.5) that continue until timeout. Default timeout is 30 seconds but can be set arbitrarily high. Scripts enumerate all windows and descendants on each iteration, which is resource-intensive.

Remediation: (1) Implement strict maximum timeouts (e.g., 10 seconds) that cannot be overridden. (2) Add exponential backoff to reduce polling frequency. (3) Limit the number of concurrent wait operations. (4) Add circuit breakers to stop operations that repeatedly fail. (5) Monitor resource usage and terminate operations that exceed thresholds.

MEDIUM Deceptive Skill Description Understates Security Risks Social Engineeringllm

The skill description 'Full Windows desktop control. Mouse, keyboard, screenshots - interact with any Windows application like a human' significantly understates the security implications of providing unrestricted desktop automation. The description frames the capability as benign user assistance but does not disclose: (1) ability to read sensitive data from any application, (2) capability to bypass security prompts, (3) potential for automated credential theft, (4) browser content extraction capabilities, or (5) lack of user confirmation requirements. Users may install this skill without understanding they are granting complete system control.

SKILL.md

Description: 'Full Windows desktop control. Mouse, keyboard, screenshots - interact with any Windows application like a human.' This benign framing does not mention data exfiltration risks, credential access, or security bypass capabilities that are present in the scripts.

Remediation: (1) Update description to explicitly state security implications: 'WARNING: Provides unrestricted desktop automation including screenshot capture, window content reading, and keyboard/mouse control. Can access sensitive data from any application.' (2) Add security warnings in SKILL.md instructions. (3) Document which operations require user confirmation. (4) Include privacy and security considerations section.

What is in the package

25 files, 59 KB. Show the list.

File	Kind	Size
`SKILL.md`	doc	7.3 KB
`package.json`	config	441 B
`scripts/click.py`	script	601 B
`scripts/click_element.py`	script	6.3 KB
`scripts/click_text.py`	script	1.9 KB
`scripts/close_window.py`	script	804 B
`scripts/drag.py`	script	695 B
`scripts/find_text.py`	script	1.7 KB
`scripts/focus_window.py`	script	1.1 KB
`scripts/get_active_window.py`	script	475 B
`scripts/handle_dialog.py`	script	13 KB
`scripts/key_press.py`	script	582 B
`scripts/list_windows.py`	script	997 B
`scripts/maximize_window.py`	script	955 B
`scripts/minimize_window.py`	script	955 B
`scripts/mouse_move.py`	script	421 B
`scripts/read_region.py`	script	1.7 KB
`scripts/read_ui_elements.py`	script	6.0 KB
`scripts/read_webpage.py`	script	7.7 KB
`scripts/read_window.py`	script	2.1 KB
`scripts/screenshot.py`	script	520 B
`scripts/scroll.py`	script	676 B
`scripts/type_text.py`	script	513 B
`scripts/wait_for_text.py`	script	1.6 KB
`scripts/wait_for_window.py`	script	1.1 KB

External hosts referenced

github.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://clawhub.ai/skills/windows-control
Raw scan result: windows-control-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/clawhub-ai-windows-control.svg)
Request a re-scan