windows-automation
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for ingesting data from untrusted sources such as browser windows and the system clipboard, which provides a surface for indirect prompt injection attacks.\n
- Ingestion points: Untrusted data enters the agent context via
ui_read,ui_read_table, andclipboardas described in SKILL.md.\n - Boundary markers: The skill lacks instructions for using delimiters or boundary markers to isolate external data from the agent's core instructions.\n
- Capability inventory: The documented capabilities include
ui_click,ui_type,file_save, andui_macro, which could be manipulated by malicious content in the processed UI.\n - Sanitization: No sanitization, filtering, or validation steps are prescribed for the ingested UI text.\n- [DYNAMIC_EXECUTION]: The skill supports the creation and replay of
ui_macrosequences, which involves replaying recorded UI interactions at runtime.\n- [NO_CODE]: No executable code is provided within the skill; it contains only markdown instructions for utilizing the windows-mcp server.
Audit Metadata