computer-use
Warn
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and installs external components using
npx skills add. These components originate from third-party repositories includingstablyai/orca@computer-use,web-infra-dev/midscene-skills@computer-automation, andam-will/codex-skills@gemini-computer-use, which are not verified trusted sources. - [COMMAND_EXECUTION]: The script
scripts/computer_use_runner.pyexecutes shell commands usingsubprocess.run(shell=True). This is used to programmatically trigger the installation of fallback skills based on a provided index. - [REMOTE_CODE_EXECUTION]: The mechanism for adding fallback skills allows for the ingestion of remote code and instructions from unverified third-party registries. This creates a supply chain risk where the agent may execute logic controlled by external entities.
Audit Metadata