Windows 桌面控制

Windows 桌面控制工具 (仅Windows) - 截屏、窗口管理、鼠标键盘控制、进程管理、系统信息。当用户要求截屏、查看进程、关闭程序、桌面控制时使用此技能。

This skill appears to do what it claims, but it provides powerful capabilities (taking screenshots, reading/writing clipboard, controlling mouse/keyboard, killing processes). Before installing: ensure you only enable it on a trusted Windows machine; verify you are comfortable with screenshots saved to ~/Pictures/OpenClaw and clipboard access; install pip dependencies from a trusted source (pip install pyautogui mss pillow) and review the included script if you want to confirm there are no hidden behaviors. If you don't want an agent to perform these actions autonomously, avoid granting it broad autonomous invocation or consider restricting when the skill can be used. Also note the registry metadata should indicate Windows-only — avoid installing on non-Windows hosts where the tool may fail.

Type: OpenClaw Skill Name: windows-desktop-control Version: 1.0.3 The skill provides high-risk desktop automation capabilities including screen capture, process management, and clipboard access. While it implements some security controls like a process whitelist and an explicitly disabled 'exec' command, it contains a shell injection vulnerability in scripts/desktop_ctrl.py; the clipboard_set function fails to sanitize PowerShell subexpressions (e.g., $(...)), which could allow arbitrary command execution. These risks appear to be unintentional vulnerabilities rather than deliberate malice.