Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-09
This is a documentation-only skill: it contains a Markdown reference guide for the third-party macOS command-line tool 'Peekaboo', plus a skill card and metadata file. There is no script or executable code in the package; the only thing it does is teach an agent the syntax of Peekaboo commands for taking screenshots, reading the clipboard, clicking, typing, and managing apps and windows. Installation metadata instructs the agent to install Peekaboo via Homebrew from a third-party tap (steipete/tap/peekaboo), so a binary from outside the package would be downloaded and run. The capabilities the tool itself grants are broad: screen recording and Accessibility permissions mean anything visible on screen, including passwords and clipboard contents, can be captured, and input can be synthesized into any application. Nothing in the files exfiltrates data, contacts hidden servers, or tries to override the agent's rules; the only URLs mentioned are the project homepage, the registry, and a placeholder example. The risk comes from the power of the underlying tool and the external Homebrew install, not from hidden behavior in this package.
| Declared purpose | "Capture and automate macOS UI with the Peekaboo CLI" - a reference guide for using the Peekaboo command-line tool to inspect screens, target UI elements, drive keyboard/mouse input, and manage apps, windows and menus on macOS. |
| Observed behavior | The package is purely descriptive Markdown. It lists Peekaboo subcommands and shows example shell invocations (screenshots, clicks, typing, window management, clipboard, dock/menu control). It declares a Homebrew install step for the external 'peekaboo' binary. No embedded scripts, no network calls made by the package itself, no file writes, no credential access, no obfuscation, and no instructions attempting to redirect or override agent behavior. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| shell | needed | All documented usage is shell invocation of the `peekaboo` binary (e.g. SKILL.md line 62 opens a bash block; lines 63-68, 92-97, 108-111 etc.). The skill's whole function is to have the agent run these commands. |
| install_packages | needed | SKILL.md line 5 metadata declares a Homebrew install from a third-party tap: "kind":"brew","formula":"steipete/tap/peekaboo". The binary is fetched from outside this package and is not auditable here. |
| filesystem_read | needed | Screen capture and clipboard read (`clipboard`: read/write clipboard (text/images/files), SKILL.md line 44) can surface arbitrary local content. |
| filesystem_write | needed | Examples write screenshot/capture output to paths such as /tmp/see.png and /tmp/capture (SKILL.md lines 65, 92, 108, 116). |
| credentials | exceeds purpose | No credentials are read by the package, but the documented tooling can expose them: `config`: init/show/edit/validate, providers, models, credentials (line 22), and an example types a literal password into an app (line 96). Screen recording also captures anything on screen. |
| other | needed | Requires macOS Screen Recording and Accessibility permissions (SKILL.md line 152), which grant broad observation and control of the entire desktop, including synthetic keyboard/mouse input into any application. |
| severity | finding |
|---|---|
| medium | Installs an external binary from a third-party Homebrew tap The skill triggers installation of the `peekaboo` executable from a personal Homebrew tap rather than a vetted core formula. The contents of that binary are not part of this package and cannot be audited here; trust is transferred entirely to the publisher's tap. SKILL.md:5 "install":[{"id":"brew","kind":"brew","formula":"steipete/tap/peekaboo","bins":["peekaboo"],"label":"Install Peekaboo (brew)"}] |
| medium | Requests the two broadest macOS automation permissions Screen Recording allows capture of everything displayed, including password managers, banking pages and secrets in terminals. Accessibility allows synthesizing clicks and keystrokes into any application. Together these permit an agent to observe and control the whole machine's UI, including actions that spend money or move funds, without further prompts. SKILL.md:152 - Requires Screen Recording + Accessibility permissions. |
| medium | Clipboard read/write, including files The documented tool can read the clipboard, which commonly contains copied passwords, API keys or one-time codes, and can also write to it. Nothing in this package exfiltrates that data, but the capability is available to whatever the agent decides to do. SKILL.md:44 - `clipboard`: read/write clipboard (text/images/files) |
| low | Example demonstrates typing a password into a login form The 'most reliable flow' example walks through automating a login: clicking a field, typing an email address, tabbing, then typing a password and pressing return. This normalizes driving credential entry through the agent, which increases the chance of secrets being handled or logged in automation runs. SKILL.md:96 peekaboo type "supersecret" --app Safari --return |
| low | Tool can execute external script files The documented CLI supports running `.peekaboo.json` script files, meaning a sequence of UI actions can be executed from an arbitrary file. No such script is bundled here, but an agent following this guide could be induced to run one supplied later. SKILL.md:27 - `run`: execute `.peekaboo.json` scripts |
| low | Documented subcommand manages stored credentials The CLI includes credential management for AI providers. Displaying or editing this config could reveal API keys. The package itself does not invoke it, but it is listed as an available capability for the agent. SKILL.md:22 - `config`: init/show/edit/validate, providers, models, credentials |
| info | Publisher discloses the main risks The skill card explicitly documents the screen/clipboard exposure and permission risks and recommends limiting use to trusted machines. Disclosure is consistent with the observed content, which supports CAUTION rather than a harsher verdict. skill-card.md:19 Risk: The skill can inspect screen and clipboard contents and drive macOS UI input, which can expose secrets or perform unintended actions. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:7 |
| example.com | not in the service index | SKILL.md:121 |
| peekaboo.boo | not in the service index | SKILL.md:4 |
| Binaries invoked | bash |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 153 | 7a87a01399f99780… |
_meta.json | 6 | d20a8365b4cfac1a… |
skill-card.md | 41 | 06450f4d081e49e5… |
For agents
JSON: https://agenteconomy.report/k/peekaboo.audit.json · badge: https://agenteconomy.report/k/peekaboo.audited.svg ·
skill rating: /k/peekaboo · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).