desktop-rpa-computer-use
Warn
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill mandates an auto-installation policy for the 'windows-mcp' package if it is not detected on the host system. It instructs the agent to use package runners like 'uvx' or 'pip' to fetch this software from remote registries.
- [COMMAND_EXECUTION]: The agent is instructed to execute shell commands to manage its environment and capabilities. Specifically, it uses 'uvx windows-mcp' and 'npx skills add' to dynamically download and integrate functionality from external repositories including 'web-infra-dev/midscene-skills' and 'am-will/codex-skills'.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it is designed to ingest and process unstructured data from the GUIs of various third-party desktop applications.
- Ingestion points: GUI labels, text fields, and window content from tax and accounting software (e-Faktur, Accurate, MYOB, etc.).
- Boundary markers: The instructions do not specify any delimiters or safety warnings to distinguish between application data and agent instructions.
- Capability inventory: The skill possesses extensive capabilities including package installation (uvx, pip, npx), file system writes (audit logs), and comprehensive GUI control (mouse/keyboard automation).
- Sanitization: There is no evidence of sanitization, filtering, or validation of the content retrieved from desktop application interfaces before it is processed by the agent.
Audit Metadata