Xia Desktop Agent

Windows桌面自动化代理。通过自然语言或预设指令控制桌面：截图、点击、输入、按键、打开应用、微信发消息/文件、ToDesk远程连接。Use when user asks to control desktop, send WeChat messages, establish ToDesk remote conn...

This skill largely does what it says (Windows GUI automation), but review and take precautions before installing: - Local LLM dependency: task_planner posts to http://127.0.0.1:18789. Ensure you have a trusted local LLM at that address or modify the code; otherwise planning will fail or unexpectedly reach another network endpoint. - Screenshots can contain sensitive info (passwords, private documents). The workflow encourages sending screenshots to an 'image' tool for OCR — confirm that any OCR/image tool is local and trusted before permitting automatic uploads. - open_app uses subprocess.Popen(cmd, shell=True) for arbitrary app names. That can execute arbitrary shell commands if the 'app' string is attacker-controlled. If you will accept free-text plans, consider restricting allowed app names or removing shell=True. - SafetyChecker only warns on dangerous keywords and does not block execution. Do not rely on it to prevent destructive actions; test in a sandboxed VM or non-sensitive machine first. - WeChat file send can be used to transmit local files. Avoid running the skill on machines containing sensitive files unless you trust both the skill and the human/agent invoking it. Recommended actions: run code review in your environment, run the skill in an isolated VM for testing, harden plan_task to a trusted LLM endpoint, sanitize or whitelist values passed to open_app, and ensure any OCR/image calls require explicit human approval before sending screenshots off-host.

Type: OpenClaw Skill Name: xia-desktop-agent Version: 1.0.0 The skill bundle provides extensive Windows desktop automation capabilities that pose a high security risk. Key indicators include a hardcoded ToDesk device code ('401315614') in both `SKILL.md` and `scripts/presets.py`, combined with a workflow designed to screenshot and exfiltrate remote access passwords to the chat interface. Furthermore, the safety module in `scripts/safety.py` is deceptive; while it identifies dangerous patterns (e.g., 'format', 'shutdown', 'del'), the `check_task` function is hardcoded to return `True` and allow the operations to proceed. The agent also utilizes high-risk functions like `subprocess.Popen(shell=True)` in `scripts/desktop_agent.py` and automates sensitive applications like WeChat, creating a significant surface for unauthorized data access or remote control.