windows-automation

Pass

Audited by Gen Agent Trust Hub on Aug 13, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONNO_CODE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for ingesting data from untrusted sources such as browser windows and the system clipboard, which provides a surface for indirect prompt injection attacks.\n
  • Ingestion points: Untrusted data enters the agent context via ui_read, ui_read_table, and clipboard as described in SKILL.md.\n
  • Boundary markers: The skill lacks instructions for using delimiters or boundary markers to isolate external data from the agent's core instructions.\n
  • Capability inventory: The documented capabilities include ui_click, ui_type, file_save, and ui_macro, which could be manipulated by malicious content in the processed UI.\n
  • Sanitization: No sanitization, filtering, or validation steps are prescribed for the ingested UI text.\n- [DYNAMIC_EXECUTION]: The skill supports the creation and replay of ui_macro sequences, which involves replaying recorded UI interactions at runtime.\n- [NO_CODE]: No executable code is provided within the skill; it contains only markdown instructions for utilizing the windows-mcp server.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 13, 2026, 09:59 AM
Security Audit — agent-trust-hub — windows-automation