Programmatically control Claude Code in visible macOS Terminal windows via AppleScript for command input, screenshots, session logging, and terminal management.

What to check before installing or running this skill: - Trust and provenance: The code can type arbitrary commands into your Terminal, execute shell commands, create and read files in the project path, and capture screenshots. Only install if you trust the author/source. The registry metadata lacks a homepage and the source is 'unknown'. - Accessibility and screenshots: You will need to grant Accessibility permissions to Terminal.app and Script Editor (System Settings → Privacy & Security → Accessibility). Granting these allows the skill to simulate keystrokes and capture parts of your screen — treat this like giving a program control of your keyboard and screen. - Review package.json / dependencies locally: package-lock.json shows a dependency on @anthropic-ai/sdk and other network-capable modules, but SKILL.md and the shown code do not use an external API or request API keys. This mismatch is unexplained — open package.json and the code to confirm there are no hidden network calls before running. If you do not plan to use any cloud features, consider removing unused dependencies. - Limit workspace and permissions: Run the skill in a limited test account or VM first; point it at a directory you control (not your home dir or production codebase). The examples and tests run arbitrary commands (pytest, cat, mkdir, etc.), so avoid pointing it at sensitive paths. - Check for missing/odd metadata: package.json appears to reference a 'cli.js' binary that is not in the manifest shown; that inconsistency suggests the package may not have been packaged/tested correctly — inspect package.json and the top-level files before using. - If you need autonomous agent use: Be cautious. Autonomous invocation plus the ability to execute shell commands and take screenshots can lead to wide impact. If you must enable autonomous runs, restrict the skill's allowed inputs and workspace and monitor actions closely. If you want, I can (1) list the exact files/lines that reference network or unusual behavior, (2) inspect package.json for the missing CLI entry and dependencies, or (3) suggest a minimal, safer configuration (remove network deps, or switch to a pure-AppleScript-only implementation) you could ask the publisher to provide.

Type: OpenClaw Skill Name: claude-code-control Version: 1.2.0 The skill is classified as suspicious due to critical shell injection vulnerabilities present in its core functionality across multiple implementations, including the main `index.js` file. The `send` function in `index.js` executes user-provided commands by simulating keystrokes into a visible Terminal.app window, which can be exploited to run arbitrary shell commands (e.g., `echo hello; rm -rf /`). Similarly, the `launch` function in `index.js` interpolates the `projectPath` directly into a shell command executed via AppleScript's `do script`, posing another shell injection risk. These vulnerabilities are exacerbated by the skill's explicit requirement for macOS Accessibility permissions, granting it high privileges to control the user's system GUI. While there is no evidence of intentional malicious behavior (like data exfiltration or backdoor installation) within the skill's code, these severe vulnerabilities enable remote code execution if the inputs (`command`, `projectPath`) are not properly sanitized by the calling agent or user.