Hello,
One of the strengths of AutoHotkey is also one of it’s weaknesses. ☹
Because AutoHotkey easily connects to the Windows API (and other built-in frameworks) some “bad people” will often write viruses to take advantage / hack your computer with it. When you factor in how easy it is to compile and distribute an AutoHotkey script, you can understand why many hackers choose AutoHotkey as their preferred language.
If the script is compiled, there are some ways to try and peak inside them. However, as a general rule, I tell everyone to be very cautious when downloading executables.
For scripts that are not compiled, most well-known places (The AutoHotkey forum, AHK Reddit, Discord, etc.) do a pretty good job of watching for these kind of things however many social media places are more like the “wild west”. During our AHK Hero group calls we routinely help people determine if a script is safe and give pointers on which tools you can use to determine that as well.
So how do you know if the script you download is “safe”?
If the script is short, you can usually do a quick read through and, thanks to how straight-forward commands in AutoHotkey are, you can have a good understanding of what it is doing.
But what happens when the script is long? Let’s say over 1,000 lines?
That’s an awful lot of code to read through. We wrote AHKScriptScan to help examine files. You can watch this video to understand how to use the tool.
Is AutoHotkey Safe?- How to evaluate an AutoHotkey Script
One really important thing to take into account is the source. If you “trust” who provided the script, you’re probably okay. But if you get it from an unknown source you probably should treat it very carefully.
Additional Resources
- How to compile an AHK script
- How to protect your scripts
Joe, Isaias, Irfan & Team
This campaign was designed to allow you to jump around. At any time you can jump to any one of the emails by clicking below
P.S. In this video we talk about how we can peek inside most compiled scripts and see its source code❗
