Computer use for GUI automation tasks via VLA models. Use when the user describes a task in natural language that requires visual screen interaction and no A...
Security Analysis
medium confidenceThe skill's requirements and runtime behavior are coherent with its GUI-automation purpose, but you should review the upstream Homebrew formula/source and be aware that screenshots (which may contain sensitive data) are sent to a remote service and a local device ID file is created.
Name and description match the declared behavior: a GUI automation client that captures screenshots and uses cloud (or local) vision models to decide actions. Requesting no credentials and having both cloud and on-device modes is consistent with the stated purpose.
The SKILL.md explicitly directs the client to capture screenshots of the primary display and send them (plus the task description) to mano.mininglamp.com — this is within scope for GUI automation but intrinsically privacy-sensitive. The doc also mentions a local device-id file (~/.myapp_device_id) even though the registry metadata lists no required config paths; the skill claims it does not read clipboard or system credentials, but there is no code bundled here to independently verify that claim.
Install via a Homebrew formula Mininglamp-AI/tap/mano-cua. That's a third‑party tap (not the core brew repo), which is reasonable but worth reviewing. Windows instructions point to GitHub Releases (manual download). No install archives inside the skill bundle to inspect.
No environment variables, API keys, or credentials are requested, which aligns with the description. The only persistent artifact mentioned is a locally generated device ID file (~/.myapp_device_id); that path was not declared in the registry metadata and should be noted by users.
always:false and normal autonomous invocation. The skill displays a small status UI and may write a device-id file, but it does not require system-wide privileges or declare forced persistence. Nothing in the manifest indicates it modifies other skills or global agent settings.
Guidance
This skill is coherent for GUI automation, but exercise caution before installing and running it on machines that display sensitive information. Actions to consider: - Review the Homebrew formula (Mininglamp-AI/tap/mano-cua) and the upstream repo (GitHub) before installing to confirm what the built binary does and which endpoints it contacts. - If you are privacy-sensitive, prefer the local mode (on-device Mano-P) when available (macOS Apple Silicon) to avoid sending screenshots off-device. - Treat the device ID file (~/.myapp_device_id) as a persistent artifact; inspect its contents and permissions after first run. - Test in a controlled environment (VM or spare account) and avoid running while passwords, 2FA codes, or other secrets are visible on-screen. - Verify TLS and hostnames (mano.mininglamp.com) and consider network monitoring to confirm traffic matches the documentation. If you want a stronger assurance that only the stated data is transmitted, request the exact Homebrew formula and the task_model.py network logic from the maintainer or inspect the built binary's network calls locally before using it on sensitive systems.
Latest Release
v1.0.4
Version 1.0.4 of mano-cua introduces local, on-device inference and updates project links: - Added "local mode" for on-device MLX-based Mano-P model runs (macOS Apple Silicon only), ensuring no data leaves the machine. - Added setup guidance and CLI options for local mode, including new commands: `mano-cua check`, `install-sdk`, `install-model`, and the `--local` flag. - Expanded usage examples and full CLI command details. - Updated project homepage and package source from `HanningWang` to `Mininglamp-AI`. - Enhanced privacy section to detail local mode with no network inference. - Minor fixes and improvements to documentation structure and clarity.
More by @hanningwang
Published by @hanningwang on ClawHub
