computer-use
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from the user interfaces of third-party desktop applications.
- Ingestion points: UI accessibility trees and screenshots are retrieved from arbitrary apps via the 'orca computer get-app-state' command in SKILL.md.
- Boundary markers: Absent; the instructions do not provide delimiters or specific warnings to the agent to treat application content as data rather than instructions.
- Capability inventory: The agent has the capability to perform actions like 'click', 'set-value', 'type-text', and 'press-key' via the 'orca' CLI as defined in SKILL.md.
- Sanitization: None; elements from the accessibility tree are processed directly without validation or escaping.
- [COMMAND_EXECUTION]: The skill performs system-level interactions by executing the 'orca' CLI tool to automate desktop application usage.
- Evidence: SKILL.md defines numerous subprocess commands such as 'orca computer click', 'orca computer type-text', and 'orca computer list-apps' to control the local desktop environment.
Audit Metadata