Is lexylent/desktop-control-win safe?
https://github.com/openclaw/skills/tree/main/skills/lexylent/desktop-control-win
This Windows desktop automation skill provides legitimate functionality (window management, input simulation, process control, VSCode integration, clipboard/screenshot access) implemented via PowerShell scripts that compile C# Win32 API bindings at runtime. The installation is clean—no malicious payloads, no exfiltration code, no prompt injection, and all canary files remained intact. However, the combined capability set (keyboard injection, clipboard harvesting, screenshot, arbitrary process launch, and VSCode extension installation) is functionally equivalent to a remote access trojan's surface area, posing significant risk if the hosting LLM agent is ever manipulated via adversarial inputs. The mandatory ExecutionPolicy Bypass guidance and dynamic C# compilation patterns additionally lower the security baseline on the target Windows host.
Category Scores
Findings (10)
HIGH Dynamic Win32 C# compilation via P/Invoke in all scripts -25 ▶
All four PowerShell scripts use Add-Type with inline C# to compile and load Win32 API bindings at runtime (user32.dll: SetForegroundWindow, mouse_event, SetCursorPos, EnumWindows, GetWindowText, etc.). This creates JIT-compiled native code executing in the PowerShell process with the full permission set of the calling user, bypassing PowerShell's type-safety boundaries.
HIGH ExecutionPolicy Bypass normalized in all documented invocations -20 ▶
Every code example in SKILL.md includes -ExecutionPolicy Bypass, instructing the LLM agent to always disable Windows script execution policy enforcement. This overwrites a security control that exists specifically to prevent unauthorized script execution and conditions users to expect this flag as normal.
HIGH Full desktop automation surface matches remote access trojan capability set -35 ▶
The combined capability set—keyboard and mouse simulation, screenshot capture, clipboard read/write, arbitrary process launch, process termination, and VSCode extension installation—is functionally identical to what a remote access trojan provides. While each capability is documented and user-facing, an LLM agent with this skill active presents an enormous attack surface if the agent itself is compromised via prompt injection or adversarial user input.
HIGH Clipboard read capability exposes secrets copied by user -20 ▶
The clipboard-get action reads and outputs the full clipboard content to the agent. Users routinely copy passwords, API keys, SSH keys, and tokens to the clipboard. An LLM agent that reads the clipboard could inadvertently expose or log this sensitive material.
MEDIUM Screenshot capability can capture sensitive screen content -15 ▶
The screenshot action captures the full primary screen or a specific window and saves to a path. If the agent takes screenshots during normal operation, any sensitive data visible on screen (passwords, private keys, financial data) is written to a file that could be further processed or transmitted.
MEDIUM Arbitrary VSCode extension installation -15 ▶
The install-extension action runs 'code --install-extension
MEDIUM Arbitrary process launch by full path -15 ▶
The process-manager start action and app-control launch action accept arbitrary executable paths and arguments, allowing the agent to start any program on the system. Combined with keyboard simulation, this could be chained to execute shell commands without the user directly requesting them.
LOW Keyboard simulation can inject commands into focused terminals -10 ▶
The type-text and send-keys actions send keystrokes directly to whatever window is currently focused. If a terminal or code editor is focused, the agent could be tricked via adversarial user data into typing arbitrary commands, including ones that pipe data to an external endpoint.
INFO Canary file reads appear in auditd PATH log but all files confirmed intact 0 ▶
auditd PATH records show open/read syscalls on .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and .config/gcloud/application_default_credentials.json at both 1771942645 (pre-install baseline) and 1771942665 (post-install). The monitoring system's own canary integrity check confirms all files are unmodified and no content was exfiltrated. The PS1 scripts cannot execute in the Linux audit environment, so skill-driven access is ruled out.
INFO No prompt injection, instruction override, or hidden content detected 0 ▶
SKILL.md contains no attempts to override system instructions, switch personas, fetch external URLs, or hide instructions via unicode or markup tricks. Safety rules are user-protective and require confirmation before destructive actions.