windows-use
Warn
Audited by Socket on May 3, 2026
1 alert found:
AnomalyAnomalyscripts/focus-and-send.cmd
LOWAnomalyLOW
scripts/focus-and-send.cmd
No direct evidence of malware behavior like persistence, credential theft, or data exfiltration exists in this snippet. However, the script performs high-impact dual-use actions: it focuses a user-specified application window and injects arbitrary keystrokes into it. Additionally, embedding DELAY into a PowerShell -Command string without batch-layer validation increases the risk surface for unintended behavior if an attacker can control inputs, and the reliance on executables from a relative bin directory introduces integrity/supply-chain concerns. Overall: treat as suspicious-capable UI automation and require strict controls on who/what can invoke it and what arguments are allowed.
Confidence: 66%Severity: 60%
Audit Metadata