How do I install the Cua Localhost skill?

Run npx skillmds@latest add code-yeongyu/cua-localhost in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Cua Localhost safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cua Localhost?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cua Localhost free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cua Localhost?

code-yeongyu (@code-yeongyu) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cua Localhost by code-yeongyu — Agent Skill

Name: Cua Localhost
Author: code-yeongyu

Cua Localhost

Drive the user's host machine directly through Cua, with no sandbox. Maps to Cua's Localhost API. Higher risk - the agent can click, type, and run shell commands on the real desktop. Use only when the user explicitly opts in and read the safety section first. Triggers - "control my computer", "click here", "use my real Chrome", "no sandbox", "내 컴퓨터 자동화".

code-yeongyu cd02b4d 2.6 KB Updated Sep 17, 2026

File contents

Localhost (unsandboxed)

When mode: "localhost" is set in .pi/cua.jsonc, Cua connects to your host machine directly. There is no sandbox: every click, keystroke, scroll, and shell command happens on the real OS.

Activation

// .pi/cua.jsonc
{
  "mode": "localhost",
  "localhost": {
    "confirmDestructive": true
  }
}

Tools that work in this mode

cua_screenshot, cua_click, cua_type, cua_key, cua_scroll - all without a sandbox argument. For host shell execution use Pi's built-in bash tool. ComputerAgent-style autonomous delegation is no longer shipped here - the main pi agent loop drives the cua surface directly, and bash-level cua do task ... invocations are documented in the global cua-skill for callers that explicitly want sub-agent delegation.

cua_sandbox_start, cua_sandbox_stop, cua_sandbox_list are disabled.

Required permissions

macOS

Accessibility - System Settings > Privacy & Security > Accessibility

add your terminal / Pi binary
Screen Recording - same panel, Screen Recording
Automation - approve when prompted, or add manually for the apps you want to drive

Linux

X11 desktop (Wayland is NOT supported by Cua's localhost mode)
cua-auto controls input through pynput and captures screenshots through its Python screen backend

Windows

Localhost mode is best-effort on Windows; prefer local QEMU VM instead.

Safety guardrails

Confirm destructive shell. With confirmDestructive: true (default) the extension prompts before running shell commands containing patterns like rm -rf, dd, or curl ... | sh.
Never type secrets. Do not paste API keys or passwords; the model can see what you type.
Prefer sandbox mode for anything that opens unknown URLs or runs untrusted code.
Stop immediately if a screenshot shows unexpected content - the agent may have been redirected.

When to choose localhost

Driving your real browser/IDE because the workflow needs your real cookies/sessions.
Cross-window automation that does not fit in a sandbox.
Lightweight scripting where spinning up a VM is overkill.

For anything else, prefer local sandbox mode.

---name: cua-localhostdescription: Drive the user's host machine directly through Cua, with no sandbox. Maps to Cua's Localhost API. Higher risk - the agent can click, type, and run shell commands on the real desktop. Use only when the user explicitly opts in and read the safety section first. Triggers - "control my computer", "click here", "use my real Chrome", "no sandbox", "내 컴퓨터 자동화".---# Localhost (unsandboxed)When `mode: "localhost"` is set in `.pi/cua.jsonc`, Cua connects to yourhost machine directly. There is no sandbox: every click, keystroke, scroll,and shell command happens on the real OS.## Activation```jsonc// .pi/cua.jsonc{ "mode": "localhost", "localhost": { "confirmDestructive": true }}```## Tools that work in this mode`cua_screenshot`, `cua_click`, `cua_type`, `cua_key`, `cua_scroll` - allwithout a `sandbox` argument. For host shell execution use Pi's built-in`bash` tool. ComputerAgent-style autonomous delegation is no longershipped here - the main pi agent loop drives the cua surface directly,and bash-level `cua do task ...` invocations are documented in theglobal `cua-skill` for callers that explicitly want sub-agentdelegation.`cua_sandbox_start`, `cua_sandbox_stop`, `cua_sandbox_list` are disabled.## Required permissions### macOS- **Accessibility** - System Settings > Privacy & Security > Accessibility > add your terminal / Pi binary- **Screen Recording** - same panel, Screen Recording- **Automation** - approve when prompted, or add manually for the apps you want to drive### Linux- X11 desktop (Wayland is NOT supported by Cua's localhost mode)- `cua-auto` controls input through pynput and captures screenshots through its Python screen backend### Windows- Localhost mode is best-effort on Windows; prefer local QEMU VM instead.## Safety guardrails1. **Confirm destructive shell.** With `confirmDestructive: true` (default) the extension prompts before running shell commands containing patterns like `rm -rf`, `dd`, or `curl ... | sh`.2. **Never type secrets.** Do not paste API keys or passwords; the model can see what you type.3. **Prefer sandbox mode** for anything that opens unknown URLs or runs untrusted code.4. **Stop immediately** if a screenshot shows unexpected content - the agent may have been redirected.## When to choose localhost- Driving your real browser/IDE because the workflow needs your real cookies/sessions.- Cross-window automation that does not fit in a sandbox.- Lightweight scripting where spinning up a VM is overkill.For anything else, prefer `local` sandbox mode.

Frequently asked questions