Scan Report
8 /100
Desktop Automation Skill
Complete desktop automation for Windows/macOS/Linux with mouse/keyboard control, OCR, image recognition, and macro recording
Legitimate desktop automation skill with comprehensive safety features, well-documented behavior, and no malicious functionality detected.
Safe to install
This skill is safe to use. Ensure pyautogui version is pinned in requirements.txt for supply chain stability.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | READ/WRITE | READ/WRITE | ✓ Aligned | Saves macros to recorded_macro/, screenshots to ~/Desktop/, logs to ~/.openclaw/ |
| Shell | WRITE | WRITE | ✓ Aligned | Uses pyautogui for mouse/keyboard control; subprocess.Popen for GUI scripts |
| Network | NONE | NONE | — | No network requests found in any module |
| Environment | NONE | NONE | — | Only reads AUTOMATION_LOG_DIR and AUTOMATION_SAFE_MODE for configuration |
| Clipboard | WRITE | WRITE | ✓ Aligned | copy_to_clipboard and paste_from_clipboard implemented via pyperclip |
| Browser | NONE | NONE | — | No browser automation features |
| Database | NONE | NONE | — | No database access |
| Skill Invoke | READ | READ | ✓ Aligned | Loads macro JSON files for playback; launches scripts/record_macro.py and script… |
1 High 4 findings
High IP Address 硬编码 IP 地址
4.10.0.84 DEPENDENCIES.md:18 Medium External URL 外部 URL
https://img.shields.io/badge/License-MIT-yellow.svg SKILL.md:3 Medium External URL 外部 URL
https://opensource.org/licenses/MIT SKILL.md:3 Medium External URL 外部 URL
https://img.shields.io/badge/OpenClaw-Skill-blue SKILL.md:4 File Tree
23 files · 172.4 KB · 5030 lines Python 14f · 3666L
Markdown 5f · 1272L
JavaScript 1f · 38L
Text 2f · 27L
YAML 1f · 27L
├─
▾
lib
│ ├─
__init__.py
Python
│ ├─
actions.py
Python
│ ├─
advanced_automation.py
Python
│ ├─
automation.py
Python
│ ├─
image_recognition.py
Python
│ ├─
macro_player.py
Python
│ ├─
ocr_engine.py
Python
│ ├─
safety_manager.py
Python
│ ├─
safety.py
Python
│ ├─
utils.py
Python
│ └─
vision.py
Python
├─
▾
scripts
│ ├─
play_macro.py
Python
│ ├─
record_macro.py
Python
│ └─
test_automation.py
Python
├─
AUTHORS.md
Markdown
├─
CONTRIBUTING.md
Markdown
├─
DEPENDENCIES.md
Markdown
├─
LICENSE.txt
Text
├─
README.md
Markdown
├─
requirements.txt
Text
├─
skill.js
JavaScript
├─
SKILL.md
Markdown
└─
skill.yaml
YAML
Dependencies 6 items
| Package | Version | Source | Known Vulns | Notes |
|---|---|---|---|---|
pyautogui | >=0.9.53 | pip | No | Version not pinned - recommend pinning to specific version |
pygetwindow | >=0.0.9 | pip | No | Version not pinned |
Pillow | >=8.0.0 | pip | No | Version not pinned |
opencv-python | >=4.5.0 | pip | No | Version not pinned |
pytesseract | >=0.3.10 | pip | No | Version not pinned |
pyperclip | >=1.8.2 | pip | No | Version not pinned |
Security Positives
✓ Safe mode enabled by default with dangerous pattern detection
✓ Dry-run mode available on all actions for safe testing
✓ Comprehensive audit logging to ~/.openclaw/skills/desktop-automation-logs/
✓ Thread-safe implementation with proper locking
✓ Explicit privacy warnings about recording all keyboard/mouse events
✓ Credential protection: dangerous patterns (rm, sudo, /etc/, password, etc.) are blocked
✓ No network requests or data exfiltration
✓ No obfuscation, base64 payloads, or hidden functionality
✓ Well-structured, documented code with error handling
✓ Macro files validated before execution