WinControl

Provides an HTTP API on Windows to capture on-demand screenshots and remotely control mouse and keyboard actions via POST requests on port 8767.

What to consider before installing/running WinControl: - Function & risk: This skill runs a local HTTP server (port 8767) that can take screenshots and fully control your mouse and keyboard. That capability is powerful and dangerous if the API is reachable by untrusted code or remote hosts. - Authentication: There is no built-in authentication or access control. Only run this if you understand and control the machine and network (or add your own authentication/restrict binding to localhost and firewall rules). - Provenance concerns: Packaging metadata is inconsistent (multiple different versions and licenses in skill.json, _meta.json, and changelog). The registry entry listed no homepage/source but skill.json references a GitHub URL — that mismatch reduces trust. Prefer skills with clear, consistent provenance and a verified upstream repository. - How to reduce risk: Run in a sandbox or disposable VM, restrict network access (block external access to port 8767), bind the server explicitly to localhost only, add an authentication layer (reverse proxy with basic auth or token), and review the full server.py source yourself. If you must run on your workstation, avoid running when remote access or port forwarding is possible. - Testing: Inspect server.py for any network calls or unexpected file access (we saw only local file operations and Win32 API calls). Start the server in an isolated environment first and watch for unexpected behavior. - When not to install: Do not run this on a production machine, multi-user server, or any machine exposed to untrusted networks without adding strong access controls. If you want, I can (a) list the exact lines in server.py that implement the HTTP handlers and cleanup so you can audit them, or (b) suggest a minimal wrapper that binds to 127.0.0.1 and requires a bearer token to reduce risk.