trycua/cua is a toolkit for building and testing AI agents that operate computers by seeing screens, clicking controls, and typing across operating systems and virtual machines. It serves agent developers, benchmark authors, and teams generating training data for computer-use models. Catalogue add-ons provide ways to operate Cua drivers and related agent workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add trycua/cua --skill cua-drivergit clone --depth 1 https://github.com/trycua/cuaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/trycua/cua/cua-driver)<a href="https://agentmods.dev/skills/trycua/cua/cua-driver"><img src="https://agentmods.dev/badge/skills/trycua/cua/cua-driver/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/trycua/cua/cua-driver"><img src="https://agentmods.dev/badge/skills/trycua/cua/cua-driver.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 25 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Prompt Injection · line 667 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 668 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 669 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 670 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 840 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 1071 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 840 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 842 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 845 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 847 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 849 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 852 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 853 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 1074 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 854 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 1068 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 1068 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 1070 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 1071 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 1072 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.02579 |
| Opus 5.5 | $0.00039 | $0.01032 |
| Sonnet 5.5 | $0.00020 | $0.00516 |
| Haiku 4.5 | $0.00010 | $0.00258 |
Grade A, and why
cua-driver scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.
cua-driver
Operate one exact target, observe it narrowly, act by element, and verify the user's postcondition at checkpoints.
Efficient loop
The MCP server instructions carry the same rules, so they apply even when this file is not opened.
- Start with a targeted read:
get_window_state({pid, window_id, query:"Save"})returns about 2K chars where a full snapshot is about 42K. Bound large trees withmax_elements/max_depth. Widen only if the target is missing. - Act by
element_token: row[N]of a read is<snapshot_id>:N(for example"s0000002a:11", not"11"). Use pixels only for surfaces missing from the tree. - Act through
run_stepswithobserve:{}, even for a single step. It runs the steps, stops at the first failure, and returns only what changed since your last read, so you do not need a separate read after acting; see Workflow. When the flow needs logic between actions (a loop, a branch on what the app shows, a retry), write it as onerun_scriptinstead; see Workflow. - To re-read a window, pass
since:"latest": you get the changed rows, not the whole tree. To just look, useinclude_accessibility_tree:falsewhere advertised (it keeps the current tokens valid). Do not usemax_elements:1or a junkqueryto get a picture. - Verify at checkpoints (after a meaningful state change, before finishing), not after every action. One
verify_stateor one targetedget_window_stateis usually enough.
Act
| Goal | Tool or command | Read when needed |
|---|---|---|
| Check installation and capabilities | cua-driver --version, status, doctor, describe <tool>; MCP tools/list |
Runtime |
| Install, update, or grant macOS permissions | update --apply, permissions status; MDM, authorized VNC approval, or ask the user |
macOS |
| Find or open the requested app | list_apps, list_windows, launch_app |
Current platform guide below |
| View a local file in the GUI | launch_app({bundle_id, urls:["file:///…"]}) opens it in that app |
Current platform guide below |
| Observe one window | get_window_state({pid, window_id, query}) |
Workflow |
| Act on a control | click / type_text with a fresh element_token and exact window target |
Workflow |
| Act and see what changed in one call | run_steps({steps:[{tool,args},...], observe:{}}); stops at the first failure |
Workflow |
| Loop, branch or retry in one call | run_script({script}): JavaScript over the cua API, sandboxed, time and call limits |
Workflow |
| Use pixels when semantics cannot reach it | Fresh target screenshot, then x,y on the same target |
Workflow |
| Verify the outcome | verify_state({pid, window_id, expect}) or a fresh snapshot read by the agent |
Workflow |
| Operate the authorized desktop | get_desktop_state → input with target:{kind:"desktop",display_id:"primary"} → get_desktop_state |
Workflow, Linux on Wayland |
| Drive supported browser page content | get_browser_state → browser_prepare from detail.next_call if refused → typed browser action |
Browser |
| Browser tools refuse in the background | Not blocked: fill the page through get_window_state + set_value/click; if the first read shows only browser chrome, read again. BLOCKED only after that fails |
Browser |
| Record an explicitly requested run | start_recording → actions → stop_recording; verify artifacts |
Recording |
| Finish | Stop after proof; end_session for this run, not cua-driver stop on a shared service |
Runtime |
What ships with it
10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed f771345ea965
- 2d ago Changed · +3 lines bff04eab4d1d
- 5d ago Changed · +3 lines 0f19a22accd7
- 7d ago Changed be1868e8b9a8
- 8d ago Changed 5307bbc0bfac
- 9d ago Changed af0a809f6d40
- 10d ago Changed 752b620d5d42
- 11d ago Changed · +1 lines f121df27deaf
- 13d ago Changed 72b3b525d784
- 14d ago First seen · 120 lines · 98 tokens per session scan A 42713610e649
cua-driver is a skill published in the GitHub repository trycua/cua (30,575 stars, last pushed today), licensed MIT. It adds 98 tokens to every session and 2,579 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
peekaboo
Use Peekaboo for macOS screenshots, Accessibility inspection, and background app/window/UI automation, including fallback computer use when the primary tool cannot handle an authorized task.
vellum-browser-use
Browse the web using assistant browser CLI commands.
asc-app-create-ui
Create a new App Store Connect app record via browser automation. Use when there is no public API for app creation and you need an agent to drive the New App form.
apple-notes
Manage Apple Notes via memo CLI: create, search, edit.
turix-mac
Computer Use Agent (CUA) for macOS automation using TuriX. Use when you need to perform visual tasks on the desktop, such as opening apps, clicking buttons, or navigating UIs that don't have a CLI or API.
macos-harness
Read and operate the apps on this Mac from the shell. Use it when a task needs an app's UI and no API, CLI or purpose-built tool can do it.