Win Control

Control Windows mouse clicks and keyboard inputs via PowerShell scripts, supporting text, shortcuts, and customizable click actions.

This skill appears to do what it says (automate Windows input) but the package contains only documentation and no PowerShell scripts; installing it as-is will require you (or the agent) to obtain the referenced .ps1 files from elsewhere. Before using or allowing autonomous invocation: 1) do not run scripts you haven't inspected — request the actual .ps1 files and review their contents for network calls, credentials access, or commands that perform I/O or spawn other processes; 2) be cautious with examples that use -ExecutionPolicy Bypass and absolute paths (these can run arbitrary code and may target user home directories); 3) test in an isolated VM or non-production account first; 4) if you only need to send messages to a service like DingTalk, prefer an API-based integration (which will require explicit credentials) rather than UI automation; and 5) if you want to proceed, ask the publisher to provide the scripts (or a trusted install mechanism) and ensure the skill package includes them so behavior is auditable.

Type: OpenClaw Skill Name: win-control Version: 1.0.0 The bundle provides high-risk Robotic Process Automation (RPA) capabilities, including mouse/keyboard control and DingTalk messaging automation via PowerShell scripts. These capabilities are inherently risky as they allow an AI agent to perform arbitrary UI actions. The actual source code for the scripts (e.g., rpa-dingtalk-smart.ps1, mouse-click.ps1) is missing, preventing verification of input sanitization for parameters like -Message or -Text, which could be vulnerable to injection. Additionally, the documentation contains hardcoded local paths (C:\Users\xl\...) and utilizes -ExecutionPolicy Bypass, indicating poor security hygiene or potential for unauthorized execution.