by 安全扫描
OpenClaw
安全
medium confidenceNULL
评估建议
This skill is coherent: it expects you to install a separate CUA server that will actually control your desktop. Before installing or enabling it: (1) inspect the cua-computer-sdk and cua-computer-server source (PyPI package and GitHub repo) for malicious code; (2) avoid binding the server to 0.0.0.0 or exposing it to networks unless you enforce authentication and firewall rules; (3) prefer running the server in an isolated VM or disposable environment, not on your primary machine; (4) only gran...详细分析 ▾
✓ 用途与能力
The name/description promise (control the desktop via a CUA server on port 8000) matches the SKILL.md: it documents installing/running a local cua-server and shows curl calls to /cmd and /status. No unrelated credentials, binaries, or config paths are requested in the registry metadata.
ℹ 指令范围
The SKILL.md instructs the user to install and run a local server, create systemd/launchd/Task Scheduler entries, and use curl to send commands (screenshot, click, etc.). These instructions are within scope for desktop control but they also require system/service changes (adding user to input group, setting XAUTHORITY, creating services) and enable remote command execution via the server API — which is expected for the stated purpose but is a sensitive capability.
ℹ 安装机制
The registry contains no install spec (instruction-only), but the document tells users to pip install 'cua-computer-sdk' or git clone 'github.com/trycua/cua-computer-server'. Installing third‑party PyPI packages or running code from GitHub is normal here but introduces supply‑chain risk; the skill itself does not supply vetted binaries.
✓ 凭证需求
The skill requests no environment variables or credentials in the registry. The SKILL.md references DISPLAY, XAUTHORITY, and $USER which are necessary for desktop control. It recommends using an --auth-token if the server is exposed — sensible and proportional.
⚠ 持久化与权限
The guide explicitly shows how to install the server as a persistent system service (systemd/launchd/Task Scheduler) and to run it with restart policies. That grants long‑lived background access to the desktop. The skill metadata does not request this privilege, but the instructions enable persistent elevated capability on the host and thus raise security concerns if misused or exposed to a network.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/10
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install desktop-automation
镜像加速npx clawhub@latest install desktop-automation --registry https://cn.longxiaskill.com