Security Audit: Critical findings in shell scripts, sandboxing, and data handling

[Azarmyr]

Security Audit Report

I performed a comprehensive security audit of this repository (every file — source, scripts, configs, docs). Here are the findings.

---

🔴 Critical

1. Command injection in scripts/mac/interact-element.sh
Dynamically constructs JXA code from unsanitized shell arguments via osascript -l JavaScript. Any untrusted input passed as arguments could lead to arbitrary code execution with the current user's permissions.

2. Unsandboxed native desktop control (src/native-desktop.ts)
Uses @nut-tree-fork/nut-js for raw mouse/keyboard control with zero sandboxing. The agent runs with the same permissions as the user — can click, type, and drag anywhere on screen, in any application.

3. TOCTOU vulnerability in src/index.ts
The CLI task command writes dynamically generated scripts to os.tmpdir() (typically /tmp) before executing them. This creates a Time-of-Check to Time-of-Use race condition where the script could be swapped between write and execution. Additionally, PowerShell is launched with -ExecutionPolicy Bypass on Windows.

4. Keystroke injection surface (interact-element.ps1 + interact-element.sh)
The SendKeys/keystroke actions allow typing arbitrary text into any application. If the controlling LLM is prompt-injected (e.g., via a malicious webpage captured in a screenshot), it could instruct the agent to type and execute shell commands in a terminal.

---

🟡 Suspicious

5. Screen data sent to third-party APIs
src/ai-brain.ts, src/computer-use.ts, and src/a11y-reasoner.ts send screenshots and accessibility trees to remote LLM providers. Any sensitive information visible on screen (passwords, messages, code) is transmitted. This is expected behavior for the tool's purpose, but represents a significant privacy surface with no granular controls.

6. Full browser control via CDP (src/browser-layer.ts, src/cdp-driver.ts)
Connects to Chrome via 127.0.0.1:9222 (remote debugging port). CDP grants complete browser control: navigation, page content reading, arbitrary JavaScript execution via page.evaluate(), bypassing Same-Origin Policy.

7. Dynamic JXA execution in scripts/mac/get-ui-tree.sh
Same pattern as interact-element.sh — constructs JXA dynamically from shell arguments without input sanitization.

8. SKILL.md autonomy directives
The skill file instructs the AI to operate with very high autonomy: "If a human can do it on a screen, you can too", "Be independent." While safety rails exist for destructive actions, the default stance encourages proactive operation without confirmation.

9. safety.ts relies on simple regex
The safety module uses basic regex pattern matching against LLM-generated output. This is easily bypassed and provides limited real-world protection.

---

🟢 Clean

• All config files (package.json, tsconfig, .env.example, .gitignore, LICENSE) — no issues
• No postinstall hooks or suspicious dependencies
• All pure JXA files — standard UI automation, no injection vectors
• Docs, HTML, SVG, CNAME, perf patches — no prompt injection, no hidden content
• No hardcoded API keys or secrets in source code

---

Methodology

• Full file-by-file review of all 59 files in the repository
• Automated and manual analysis of all TypeScript source, PowerShell scripts, JXA/Bash scripts, configs, and documentation
• Checked for: obfuscation, network calls, code execution, data exfiltration, credential handling, crypto operations, supply chain risks, prompt injection, hidden content

Great project concept, just flagging these for awareness. Happy to discuss any of these findings.

[itsuzef]

Thanks for the detailed audit.

That said, this project is explicitly a computer-use automation tool, by design it has access to keyboard, mouse, browser, and system interfaces. The risks described (keystroke execution, screenshot context, desktop control) are inherent to this category of tool, not unique vulnerabilities.

As long as there’s no malicious behavior (exfiltration, hidden payloads, credential harvesting, etc.), this falls under a clear “use at your own risk” model. This a bit similar to AppleScript, Selenium, or AutoHotKey.

Improvements in sanitization are always welcome, but the core capabilities shouldn’t be framed as critical vulnerabilities when they are the intended functionality!

[AmrDab]

Fixed ✅

• fix(mac): fix JXA stdout output + missing get-screen-context + cmd ke… #8 SKILL.md autonomy — rewrote with explicit safety tiers, agents can't self-approve confirm-tier actions,
  autonomous use scoped to read-only
• Accessibility bridge: SyntaxError: Unexpected end of JSON input #1 & Accessibility script error #7 JXA injection — these were flagged but the inputs come from our own LLM pipeline, not user-supplied strings
  directly. Still worth hardening in v0.5.6+

By-design (acknowledged, not bugs) ⚠️

• fix(mac): JXA get-windows stdout + doctor Anthropic error handling Fixes #1 #2 Unsandboxed native control — that's literally what the tool does. Sandboxing it would make it useless
• get-screen-context.ps1: No such file or directory #4 Keystroke injection — mitigated by safety tiers (🔴 confirm for sends/deletes). Full fix would need prompt
  injection detection, which is an industry-wide unsolved problem
• fix(mac): add get-screen-context.jxa — macOS equivalent of PS1 combined script #5 Screen data to APIs — expected behavior, documented in privacy section. Users choose their provider
• fix(mac): surface real stderr + probe System Events in isShellAvailable #6 CDP browser control — required for Smart Interaction layer. Localhost-only (127.0.0.1:9222)
• Accessibility script issue #9 Regex safety — it's a first line of defense, not the only one. Combined with the 3-tier system

Still TODO 📋

• fix: macOS keyboard support — use LeftCmd for Super key and fix Cmd+Space combo #3 TOCTOU in tmp scripts — not yet fixed. Should use unique filenames + restrictive permissions. Low priority since
  it requires local attacker with write access to /tmp
• Accessibility bridge: SyntaxError: Unexpected end of JSON input #1 & Accessibility script error #7 Input sanitization — should escape shell args in JXA scripts