Remote Install

Automates remote Windows software installation by detecting installers and controlling GUI to silently install .exe/.msi packages like Office, Adobe, and Chr...

This skill implements GUI automation for Windows installs, which can be useful, but it contains undeclared remote-control code (RustDeskController) and actively logs remote IDs and passwords to a local log file. Before using: (1) don't supply real credentials until you confirm how they are handled; (2) inspect/modify the code to remove or redact logging of sensitive inputs (avoid logging passwords/IDs); (3) run only on test or controlled machines with no sensitive data; (4) require explicit, documented consent and a secure method for passing remote credentials (avoid plaintext in logs/config); (5) consider requiring RustDesk be declared as a dependency and document the remote-connection workflow. If you are not comfortable reviewing or changing the script, treat this skill as risky and avoid installing it on production or personal machines.

Type: OpenClaw Skill Name: remote-install Version: 1.0.0 The skill bundle provides automated remote software installation by programmatically controlling the RustDesk remote desktop client and using GUI automation (pywinauto/pyautogui). While the behavior aligns with the stated purpose in SKILL.md, the script scripts/remote_installer.py contains a shell injection vulnerability in the run_command function due to the use of subprocess.run(shell=True) with unsanitized input. The capability to automate remote access credentials and perform high-privilege GUI interactions (clicking 'Next' and 'Install' buttons) poses a significant security risk if the agent is manipulated via prompt injection, though no clear evidence of intentional malice or data exfiltration was found.