Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

PhotoCHAT Photo Search

v1.0.0

Search for photos in PhotoCHAT using natural language via the CLI. Use when the user asks to find, search for, or locate photos/pictures/images using PhotoCH...

1· 384·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description match the instructions: the SKILL.md tells the agent to run the local 'photochat' CLI to perform natural-language photo searches and parse JSON output. There are no unrelated environment variables, external services, or installs requested — the need for a local 'photochat' binary is proportionate to the stated purpose.
Instruction Scope
Instructions are narrowly scoped to running 'photochat search' with JSON output, parsing the results, and presenting file paths. This is appropriate for a local photo-search skill, but it does explicitly expect absolute file paths and instructs passing them to the agent's image/display tool — which means the agent will access the user's photo files. That privacy-relevant behavior is expected for the stated purpose but is worth noting.
Install Mechanism
No install spec or code is provided (instruction-only), so nothing is downloaded or written by the skill itself. This is the lowest-risk install profile and matches the skill's description.
Credentials
The skill requires no environment variables, credentials, or config paths. The only implicit requirement is access to the local 'photochat' binary and filesystem paths for photos; those are proportional to a local photo-search capability and are not excessive.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request persistent/system-wide privileges or attempt to modify other skills. Autonomous invocation is permitted by default for skills and is not combined here with other concerning privileges.
Assessment
This skill is coherent and doesn't request credentials or install code, but it operates on your local photo library: make sure the 'photochat' app (MSIX) is installed and up-to-date, and that you are comfortable granting the agent access to image file paths (the skill will read absolute paths and may display images via the agent's image tool). If you have sensitive photos you do not want an agent to access, do not enable this skill or restrict the agent's file access. If you want stronger assurance, ask the publisher for the skill source/origin or require a signed package of the 'photochat' CLI before enabling.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ejkc9hryr2efydgdqr6724n825fme
384downloads
1stars
1versions
Updated 8h ago
v1.0.0
MIT-0

PhotoCHAT CLI Search

Search the user's photo library using PhotoCHAT's natural language search CLI.

Command

photochat search [options] <natural language query>

Uses the MSIX-packaged photochat app execution alias (v0.6.0+).

Options

FlagPurposeDefault
--jsonMachine-readable JSON outputoff
--limit NMax results5
--show-filtersPrint parsed face/date/exclusion filtersoff
--show-scoresInclude similarity scores in plain textoff
--profile NAMEForce-include a face profilenone
--day-firstParse ambiguous dates as DD/MMoff
--dry-runParse query only, skip retrievaloff

Workflow

  1. Run search with --json, --day-first, and a reasonable --limit:
photochat search --json --day-first --limit 10 show me a photo of sarah at the beach
  1. Parse JSON output:
{
  "query": "original query text",
  "intent": {
    "cleaned_query": "processed query",
    "face_filters": ["sarah"],
    "date_range": null,
    "exclude_terms": []
  },
  "total_results": 25,
  "returned_results": 5,
  "results": [
    { "rank": 1, "path": "I:/Pictures/.../photo.JPG", "score": 0.55 }
  ]
}
  1. Present results:
    • Show file paths and match count (returned vs total)
    • To display a photo, use the image tool with the path from results
    • Scores above 0.4 are decent; above 0.5 is a strong match
    • If zero results, suggest simplifying the query or check filters with --show-filters

Query Capabilities

The parser handles rich natural language:

  • Faces: "Sarah at the beach" auto-filters face profile "Sarah"
  • Dates: "from 2021", "in March", "before 2015", "from Mar 21"
  • Exclusions: "without Matt" excludes face or concept
  • Mood/style: "photos that feel cozy and warm", "vintage film look"
  • Combos: "Bella standing next to a tall building from Mar 21"

For more examples, read references/search-examples.txt.

Important

  • Always use --day-first (Australian date format DD/MM)
  • Always use --json for parseable output
  • Default --limit 5 unless user asks for more
  • First search takes 10-30s (model loading); use 60s timeout on first call
  • Result paths are absolute file paths; pass directly to the image tool

Exit Codes

CodeMeaning
0Success (includes zero-result searches)
2Argument/usage error
3Runtime/model init failure
4Storage init/access failure
5Unexpected failure

Comments

Loading comments...