ZappushZappush
SkillsUse CasesBenchmarkCommunitySign In
      Back to Skills
      matagul

      Safety Report

      Desktop Control

      @matagul

      Advanced desktop automation with mouse, keyboard, and screen control

      20,327Downloads
      148Installs
      146Stars
      1Versions
      Workflow Automation3,323

      Security Analysis

      high confidence
      Clean0.04 risk

      The package is internally consistent: it implements desktop automation (mouse, keyboard, screenshots, clipboard) and its files and docs match that purpose; it does not request unrelated credentials or surprising installs, but it is powerful and can perform sensitive actions on your machine.

      Feb 11, 20266 files1 concern
      Purpose & Capabilityok

      Name/description, SKILL.md, and the included Python code all describe and implement desktop automation (pyautogui-based mouse/keyboard control, screenshots, window management, clipboard). There are no unrelated environment variables, binaries, or install steps requested that would be inappropriate for this purpose.

      Instruction Scopeok

      Runtime instructions and code operate within the expected scope: moving/clicking the mouse, typing keys, taking screenshots, finding images on screen, and reading/writing the clipboard. These actions are sensitive (can capture screen contents and clipboard) but are directly relevant to the stated functionality; I saw no instructions to read unrelated system files, environment variables, or to send data to external endpoints.

      Install Mechanismok

      No automatic install spec is included. SKILL.md instructs the user to pip install reasonable dependencies (pyautogui, pillow, opencv-python, pygetwindow, pyperclip) — conventional for this functionality. There are no downloads from untrusted URLs or extract/install steps in the skill metadata.

      Credentialsok

      The skill does not request any environment variables, keys, or credentials. The operations (desktop control, screenshots, clipboard) do not require cloud credentials and none are declared, which is proportionate to its purpose.

      Persistence & Privilegenote

      always is false and there are no install hooks that persist automatically. However, the package includes an autonomous AIDesktopAgent class and the platform default allows model invocation (disable-model-invocation=false). That means an agent could invoke this skill autonomously to control the desktop — a normal platform capability but one that increases risk because the skill can take screenshots and control input.

      Guidance

      This skill appears to be what it claims: powerful desktop automation using pyautogui. Before installing or running it, consider the following: - Understand the power: it can move your mouse, type, press hotkeys, capture screenshots, and read/modify the clipboard — all of which can expose sensitive data or cause actions on your machine. This is expected behavior for a desktop-automation skill, not a hidden backdoor. - Prefer running in a safe environment: test in a disposable VM, non-production account, or on a system without sensitive documents open. Close important apps before running demos. - Use safety options: enable failsafe (move mouse to corner to abort) and set require_approval=True if you want manual confirmation for each action. Review demos before running them. - Beware of autonomous invocation: if you allow the agent to invoke skills autonomously, it could run sequences without your interactive confirmation. If you do not trust the skill/user code, disable autonomous invocation or only allow manual/user-invoked runs. - Review the code: if you plan to run this long-term, inspect the full ai_agent.py and any truncated parts for network calls or code that might upload screenshots/clipboard data. The provided fragments show no network exfiltration, but the files were truncated in places — verify the remaining code sections yourself. - Install dependencies from official sources and avoid running unknown binaries. If you need to grant broader privileges (e.g., run as admin), reconsider usage. If you want, I can scan the remaining truncated portions (full ai_agent.py and __init__.py) for any network calls, hidden endpoints, or suspicious behaviors to raise confidence further.

      Latest Release

      v1.0.0

      Version 1.0.0 - Initial release of the Desktop Control skill for OpenClaw. - Provides advanced automation: mouse movement/clicks, keyboard input, hotkeys, and typing speed control. - Supports screen capture, region-based screenshots, image/template matching, and pixel color detection. - Includes window management (list, activate, move, resize, minimize/maximize). - Safety features: failsafe abort, logging, approval mode, bounds checks, and emergency pause. - Detailed documentation with examples and complete API reference.

      Popular Skills

      self-improving-agent

      @pskoett · 1,456 stars

      Gog

      @steipete · 672 stars

      Tavily Web Search

      @arun-8687 · 620 stars

      Find Skills

      @JimLiuxinghai · 529 stars

      Proactive Agent

      @halthelobster · 426 stars

      Summarize

      @summarize · 415 stars

      Published by @matagul on ClawHub

      Zappush© 2026 Zappush
      HomeGuaranteeSupport

      Something feels unusual? We want to help: [email protected]