cua-driver-rs

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs include direct links to install scripts (.sh and .ps1) hosted on raw.githubusercontent.com and a GitHub releases direct-download of a PowerShell script, which are high-risk because executing remote scripts directly can deliver malware.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md’s runtime path includes get_window_state returning tree_markdown (AX/UIA/AT-SPI element labels) which is outsider-authored free text from the target application’s UI, and that text is fed into the agent’s LLM context for grounding.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README instructs running remote install scripts that fetch-and-execute code at setup time (bash -c "$(curl -fsSL https://raw.githubusercontent.com/trycua/cua/main/libs/cua-driver/scripts/install.sh)" and irm https://raw.githubusercontent.com/trycua/cua/main/libs/cua-driver/scripts/install.ps1 | iex), which are runtime-installation steps that directly execute remote content required to obtain the cua-driver dependency used by the skill.