Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-17
This package is a local desktop-automation skill. It can move and click the mouse, type text, send hotkeys, capture the screen, inspect pixels, locate images, switch windows, read and write the clipboard, and run a rule-based agent that captures screenshots during tasks. It saves screenshots to disk but has no observed network exfiltration, persistence mechanism, wallet/payment code, or hidden decoding. The optional approval mode is incomplete: screenshot and clipboard operations can occur without approval, and the documentation suggests disabling failsafe or running with administrator privileges in some cases. Because it can see and interact with anything on the desktop, it should not be used unattended around credentials, payment pages, or private data.
| Declared purpose | Advanced desktop automation with mouse, keyboard, screen control, window management, clipboard operations, and optional higher-level task planning. |
| Observed behavior | The Python code wraps PyAutoGUI, pygetwindow, and pyperclip to control the mouse, keyboard, screen, windows, and clipboard. AIDesktopAgent adds rule-based task planning, launches applications by sending Win+R and typing a command, captures before/after screenshots during task execution, and includes simplified drawing and game-loop routines. No runtime network requests, shell execution, persistence, wallet operations, or download-and-execute behavior were observed. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| other | needed | Core desktop input and observation: mouse movement, clicking, dragging, scrolling, keyboard typing, key presses, hotkeys, window activation, screen capture, pixel inspection, image matching, and clipboard read/write. Implemented in __init__.py via PyAutoGUI, pygetwindow, and pyperclip. |
| filesystem_write | needed | Saves screenshots to disk when screenshot() is called with a filename (__init__.py line 225: img.save(filename)). |
| filesystem_read | needed | Reads template image files for image matching through pyautogui.locateOnScreen (__init__.py line 259). |
| install_packages | needed | Documentation instructs pip install pyautogui pillow opencv-python pygetwindow pyperclip (SKILL.md line 56 and QUICK_REFERENCE.md line 250); no automatic install code runs. |
| network | exceeds purpose | No runtime network calls observed; only documentation links such as skill-card.md line 9 to clawhub.ai. |
| severity | finding |
|---|---|
| info | Declared purpose The skill describes itself as local desktop automation. SKILL.md:2 Advanced desktop automation with mouse, keyboard, and screen control |
| info | PyAutoGUI desktop automation library Imports the library used to move the mouse, click, type, press keys, and capture the screen. __init__.py:6 import pyautogui |
| medium | Programmatic mouse clicks The skill can click at absolute coordinates or the current pointer position with left, right, or middle buttons. This is core to the declared purpose, but can interact with on-screen payment or account controls if present. __init__.py:91 pyautogui.click(x=x, y=y, clicks=clicks, interval=interval, button=button) |
| medium | Arbitrary keyboard text entry Types any provided string into the active window. This can enter credentials or commands if the focused window is a terminal or form. __init__.py:169 pyautogui.write(text, interval=interval) |
| medium | Keyboard shortcuts can control applications Can send shortcuts such as Ctrl+C, Ctrl+V, Alt+Tab, or Win+R. Documentation examples include Win+R and Ctrl+Alt+Delete. __init__.py:195 pyautogui.hotkey(*keys, interval=interval) |
| high | Screenshot capture bypasses approval mode The screenshot method does not call _check_approval, so it can capture the screen even if require_approval=True. Screenshots may expose private documents, passwords, or tokens. __init__.py:222 img = pyautogui.screenshot(region=region) |
| medium | Writes screenshot files to disk The screenshot method saves files to arbitrary paths when a filename is supplied, as used by demos and the AI agent. __init__.py:225 img.save(filename) |
| high | Clipboard read bypasses approval mode get_from_clipboard reads whatever is in the system clipboard without calling _check_approval. This may expose copied passwords or API tokens. __init__.py:373 text = pyperclip.paste() |
| medium | Clipboard write bypasses approval mode copy_to_clipboard writes text to the system clipboard without approval check; it could overwrite a user's clipboard. __init__.py:357 pyperclip.copy(text) |
| medium | Key hold bypasses approval mode key_down and key_up change key state without _check_approval, so key combinations can be synthesized without confirmation. __init__.py:200 pyautogui.keyDown(key) |
| medium | Autonomous agent captures screenshots before and after steps AIDesktopAgent captures the screen before and after each step and returns the images in the result, which can automatically collect visible data. ai_agent.py:115 screenshot_before = self.dc.screenshot() |
| medium | App launch fallback uses raw string as command If the app is not in the knowledge base, _do_launch_app sends the raw app string to the Windows Run dialog via Win+R and Enter, allowing launch of arbitrary local commands. ai_agent.py:361 launch_cmd = app_info.get("launch_command", app) |
| info | Unused base64 import base64 is imported but never used in the provided code. No encoded payloads were observed. ai_agent.py:6 import base64 |
| low | Documentation advises disabling failsafe It recommends disabling the failsafe for performance; failsafe is the primary emergency stop for automation. SKILL.md:571 4. **Disable failsafe** for maximum performance (use with caution) |
| medium | Documentation suggests administrator privileges Encourages running Python as administrator for some operations, which would give the automation broad control over the host. SKILL.md:603 - Run Python with administrator privileges for some operations |
| info | Documentation example types a password The example shows typing a hard-coded password into a form, illustrating how the skill can be used to enter credentials. SKILL.md:505 dc.type_text("SecurePassword123", wpm=60) |
| medium | Published risk note confirms approval bypass The skill card itself reports that some sensitive actions bypass the advertised approval mode. The code confirms screenshot and clipboard methods do not check approval. skill-card.md:32 Risk: Server security guidance says some sensitive actions bypass the advertised approval mode. |
| info | Install instructions The package instructs installing Python packages; it does not run this command automatically. QUICK_REFERENCE.md:250 pip install pyautogui pillow opencv-python pygetwindow pyperclip |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| Binaries invoked | base64, bash, pip, python |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
AI_AGENT_GUIDE.md | 448 | 265239bcc5b43a04… |
QUICK_REFERENCE.md | 269 | a3b817908aea53c6… |
SKILL.md | 623 | d900c0650cfbb76f… |
__init__.py | 522 | d8f569d4efd3341e… |
_meta.json | 6 | 1e129b2678ec27f8… |
ai_agent.py | 613 | 4971f7d14c6e2c0e… |
demo.py | 238 | 5da659039f391c08… |
skill-card.md | 57 | 6c915053c9df3c51… |
For agents
JSON: https://agenteconomy.report/k/desktop-control.audit.json · badge: https://agenteconomy.report/k/desktop-control.audited.svg ·
skill rating: /k/desktop-control · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).