功能描述

Linux desktop automation and control. Use when: (1) taking screenshots of the screen or windows, (2) controlling mouse and keyboard, (3) managing windows, (4...

使用说明 (SKILL.md)

Linux Desktop Control

Name: Linux Desktop Control
Author: ouyangabel

Automate and control your Linux desktop using command-line tools. Capture screenshots, control mouse/keyboard, and manage windows.

When to Use

Take screenshots of screen or specific windows
Automate mouse movements and clicks
Simulate keyboard input
Manage and interact with windows
Build desktop automation workflows

Prerequisites

Install required tools:

sudo apt-get install scrot xdotool xclip x11-utils x11-apps

Quick Start

Take Screenshot

python3 scripts/linux-desktop.py screenshot
# Output: ~/screenshot_20240224_203901.png

List Windows

python3 scripts/linux-desktop.py list

Move Mouse and Click

python3 scripts/linux-desktop.py move 500 300
python3 scripts/linux-desktop.py click

Type Text

python3 scripts/linux-desktop.py type "Hello World"

Commands

`screenshot [path]`

Capture a screenshot of the entire screen.

Examples:

# Save to default location (/tmp/screenshot_YYYYMMDD_HHMMSS.png)
python3 scripts/linux-desktop.py screenshot

# Save to custom path
python3 scripts/linux-desktop.py screenshot ~/desktop.png

`window [window_id] [path]`

Capture a screenshot of a specific window.

Examples:

# Screenshot active window
python3 scripts/linux-desktop.py window

# Screenshot specific window
python3 scripts/linux-desktop.py window 0x12345678 ~/window.png

`active`

Get information about the currently active window.

python3 scripts/linux-desktop.py active
# Output: 🖥️ Active Window
#         ID: 0x12345678
#         Title: Terminal

`list`

List all visible windows.

python3 scripts/linux-desktop.py list
# Output: 🪟 Found 5 windows:
#         1. 0x12345678 - Terminal
#         2. 0x87654321 - Chrome

`move \x3Cx> \x3Cy>`

Move mouse cursor to specified coordinates.

Examples:

python3 scripts/linux-desktop.py move 100 200
# Moves mouse to (100, 200)

python3 scripts/linux-desktop.py move 500 300
# Moves mouse to center of 1000x600 area

`click [button]`

Click mouse button at current cursor position.

Button values:

1 - Left button (default)
2 - Middle button
3 - Right button

Examples:

python3 scripts/linux-desktop.py click
# Left click

python3 scripts/linux-desktop.py click 3
# Right click

`type \x3Ctext>`

Type text at current cursor position (must be in focused window).

Examples:

python3 scripts/linux-desktop.py type "Hello World"

python3 scripts/linux-desktop.py type "ls -la"

python3 scripts/linux-desktop.py type "sudo apt update"

`key \x3Ckeyspec>`

Press keyboard keys.

Common keys:

Return - Enter key
Escape - Escape key
Tab - Tab key
BackSpace - Backspace
Delete - Delete
Up, Down, Left, Right - Arrow keys
Home, End, Page_Up, Page_Down
F1 through F12
Ctrl+c, Ctrl+v, Ctrl+a, Ctrl+z - Key combinations

Examples:

python3 scripts/linux-desktop.py key Return

python3 scripts/linux-desktop.py key Escape

python3 scripts/linux-desktop.py key Ctrl+a

python3 scripts/linux-desktop.py key F5

`screen`

Get screen information.

python3 scripts/linux-desktop.py screen
# Output: 🖥️ Screen Info
#         Resolution: 1920x1080

Automation Examples

Basic Automation

# Move mouse, click, type, and press enter
python3 scripts/linux-desktop.py move 100 100
python3 scripts/linux-desktop.py click
python3 scripts/linux-desktop.py type "ls -la"
python3 scripts/linux-desktop.py key Return

Web Search Automation

# Open browser, navigate to Google, search
python3 scripts/linux-desktop.py move 100 50
python3 scripts/linux-desktop.py click
python3 scripts/linux-desktop.py type "https://www.google.com"
python3 scripts/linux-desktop.py key Return
sleep 2
python3 scripts/linux-desktop.py type "how to make money online"
python3 scripts/linux-desktop.py key Return

Screenshot Workflow

# Take screenshot before and after action
python3 scripts/linux-desktop.py screenshot /tmp/before.png
python3 scripts/linux-desktop.py key F5  # Refresh
sleep 1
python3 scripts/linux-desktop.py screenshot /tmp/after.png

Tips

Always check the active window before typing
Use sleep commands between actions for reliability
Take screenshots to verify state changes
Test commands one by one before building complex workflows
Use window list to find specific window IDs for targeting

Troubleshooting

"Command not found" errors:

sudo apt-get install scrot xdotool xclip x11-utils x11-apps

Permission denied:

Ensure you're running in a graphical session (X11 or Wayland)
Some actions require focus on the target window

Mouse doesn't move:

Check if another application is grabbing the mouse
Try moving the mouse manually to see if it's responsive

Security Notes

This skill can control your desktop - use with caution
Don't automate sensitive actions without verification
Always review automation scripts before running

安全使用建议

This skill appears to do what it says (control and automate a Linux desktop), but review and be cautious before installing or granting it autonomous use. Specific recommendations: - Don't run it with untrusted inputs: the Python script constructs shell commands and calls subprocess.run(..., shell=True) — text you pass (for typing, window IDs, paths) can lead to command injection. Treat it as unsafe for use with untrusted data. - If you will use it, prefer invoking it manually rather than allowing autonomous agents to call it. Autonomous agents could type commands or click things that perform sensitive actions. - Consider patching before use: replace shell=True invocations with subprocess.run([...], shell=False) and properly validate/escape user inputs (window IDs, file paths, typed text). Ensure file paths are sanitized and text is passed as program arguments rather than inline shell strings. - Install required system packages listed in SKILL.md and also ImageMagick (for 'convert'), and run the tool in a non-privileged graphical session. Avoid running in an environment where sensitive windows (password managers, terminals with secrets) are focused. - If you want the safety of this skill but lack the skills to audit/fix it, do not enable autonomous invocation and ask the publisher for a fixed version that avoids shell=True and documents all native dependencies.

功能分析

Type: OpenClaw Skill Name: linux-desktop Version: 1.0.0 The skill bundle provides legitimate Linux desktop automation capabilities. However, the `scripts/linux-desktop.py` script uses `subprocess.run(..., shell=True)` and constructs several commands (e.g., `key`, `window`, `screenshot`, `type`) with user-provided arguments without adequate sanitization or quoting. This creates critical shell injection vulnerabilities (Remote Code Execution) where a malicious prompt or user input could execute arbitrary commands on the host system. There is no evidence of intentional malicious behavior, but the severe vulnerabilities make it suspicious.

能力评估

✓ Purpose & Capability

Name/description, SKILL.md, and the included script all describe Linux desktop automation (screenshots, mouse/keyboard, window management). Required tools called by the script (scrot, xdotool, xwd/convert, xdpyinfo) align with that purpose. SKILL.md lists most prerequisites but omits the ImageMagick 'convert' dependency used in the script.

⚠ Instruction Scope

SKILL.md instructs running the bundled Python script and installing packages — that's within scope. However the script builds shell commands using user-provided values and calls subprocess.run(..., shell=True) without sanitization (e.g., type, window id, file path), creating straightforward command-injection vectors. The instructions also encourage typing arbitrary text (including commands like 'sudo apt update'), which combined with autonomous or scripted use increases risk of unintended privileged actions.

✓ Install Mechanism

No install spec (instruction-only) — lowest install risk. The skill does include a Python script that invokes system binaries; nothing in the package automatically downloads remote code or writes installers to disk.

✓ Credentials

The skill requests no environment variables, credentials, or config paths — appropriate for a local desktop automation tool.

✓ Persistence & Privilege

always:false and user-invocable:true (normal). disable-model-invocation is false (default) — the skill can be invoked autonomously, which is platform normal but increases the practical risk because the skill controls the desktop; there is no request to modify other skills or system-wide settings.

版本历史

v1.0.0

Initial release: Linux desktop automation with screenshot, mouse, keyboard, and window control

元数据

Slug linux-desktop

版本 1.0.0

许可证 —

累计安装 7

当前安装数 6

历史版本数 1

常见问题