Lens

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:23 AM UTC
• Version: 1.2.3

Overview

Lens is a disclosed personalization skill, but it creates recurring jobs that read local OpenClaw chat logs and build a persistent identity profile, so users should review it carefully before installing.

Install only if you intentionally want a long-running local personalization system that reads recent OpenClaw conversations, stores derived identity and style data in .lens, and schedules recurring background jobs. Before enabling it, review the generated cron jobs and .lens files, consider setting anonymize to true, mark sensitive messages with #private, and remove lens-distillation and lens-interview if you do not want ongoing processing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a response-styling/perspective mechanism, but it also bootstraps local state, reads historical session logs, persists derived user data, and schedules recurring background jobs. That mismatch is dangerous because users or invoking agents may authorize it for innocuous personalization without realizing it performs ongoing local data collection and persistence.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Directing the agent to run a bootstrap script and register cron jobs introduces code execution and persistence beyond the stated purpose of adopting a user's voice. This creates a durable foothold on the host and can lead to unintended background processing long after the original interaction, especially if the user did not understand they were approving scheduled automation.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Continuous ingestion of local session transcripts for 'distillation' materially expands the skill from personalization into surveillance-like background analysis of user communications. Even with claimed scrubbing and opt-out language, default ongoing access to `~/.openclaw/.../sessions/*.jsonl` risks overcollection of sensitive data and creates a privacy boundary violation if enabled under a vague personalization banner.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The prompt explicitly instructs the agent to execute a local Node.js script through the exec tool as part of routine operation, even though the skill’s stated purpose is personality distillation. This unnecessarily expands the skill’s authority from analysis into code execution, creating a path for unintended command execution, side effects, or abuse if the script or its inputs are manipulated.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The self-repair and cron synchronization steps give the skill persistence-management behavior unrelated to its declared role of expressing the user’s perspective. That mismatch increases risk because the skill can modify scheduled automation and operational state, which could be abused for persistence, unauthorized reconfiguration, or stealthy behavior outside normal user expectations.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The prompt instructs the agent to execute a local Node.js script and potentially reconfigure a cron job, which are privileged side effects unrelated to merely asking an interview question. In a prompt file for conversational profiling, this creates an unjustified execution pathway that could alter the host environment or persist automation without explicit user approval.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The prompt claims the interaction is 'data acquisition only' and forbids modification, yet earlier instructions direct the agent to update a cron job. This contradiction is dangerous because it can mislead users and reviewers about the true capabilities and side effects of the skill, undermining informed consent and control.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The bootstrap logic reads a user-specific file from ~/.openclaw/openclaw.json to derive timezone data, even though the skill could use standard system timezone APIs without touching unrelated application state. Accessing unrelated configuration expands the skill's data reach and creates unnecessary privacy exposure if the file later contains additional sensitive defaults or agent settings.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: This script enumerates recent session log files under a hardcoded agent history directory, extracts user-authored messages, and writes them into `.lens/TRACE.txt`. That behavior is a form of cross-session data harvesting and persistence that exceeds the skill's stated purpose of expressing a user's perspective, and it can expose sensitive prompts, personal data, credentials, or confidential workflow context despite partial regex-based redaction.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code accesses `process.env.HOME/.openclaw/agents/main/sessions` directly, giving the skill visibility into a broad set of local agent session artifacts unrelated to the immediate task. Hardcoded access to accumulated session history expands the data exposure surface and bypasses least-privilege design, especially for a skill whose description does not justify filesystem collection of prior conversations.

Vague Triggers

High

• Confidence: 88% confidence
• Finding: The activation guidance says to use the skill whenever an agent needs to act, speak, or decide with the user's perspective, which is so broad that it could trigger in many unrelated contexts. Overbroad invocation increases the chance that the skill's file access, persistent state changes, and scheduled jobs are activated in situations where they are unnecessary or unexpected.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Repeated broad 'use when' language without scope boundaries encourages default use and normalizes the skill as a general-purpose behavior layer. In this context, that is risky because the skill is not just stylistic; it also changes local state and may lead to data-processing side effects if the full lifecycle is followed.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directs silent execution of a Node.js script via `exec` with no user-facing notice, even though the visible task appears to be asking a question. Hidden tool use reduces transparency and can conceal code execution, local file access, or other side effects from the user.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The migration code silently renames files in the user's working directory under .lens without confirmation, backup validation, or transactional safeguards. Unannounced modification of user data can cause integrity loss, confusion, and accidental destruction of prior state, especially when this runs automatically during bootstrap.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The code silently reads a user-specific config file in HOME to obtain timezone information without any user-facing disclosure. Even if the immediate field is low sensitivity, hidden access to per-user configuration violates least surprise and normalizes broader unauthorized config inspection.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script persists session-derived user content into `.lens/TRACE.txt` without any visible notice, consent mechanism, or disclosure in this file. Silent creation of a derived trace increases privacy risk because sensitive conversation data is copied into a new location, potentially widening access and retention beyond what the user expects.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: This template explicitly solicits extensive highly sensitive data, including medical context, geolocation, family relationships, digital identities, hardware inventory, and life timeline details, without any privacy warning, data minimization, purpose limitation, or handling safeguards. In the context of a skill meant to shape agent behavior around a user's identity and perspective, this creates a significant risk of over-collection, profiling, deanonymization, and downstream misuse if the information is stored, exposed, or reused beyond the user's expectations.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The mission is to build a refined ‘digital shadow’ that replicates the user’s mind, character, and speech, which is a direct profiling objective over sensitive personal expression. Even without explicit exfiltration, this creates concentrated behavioral and psychological dossiers that can enable impersonation, manipulation, or privacy harm if exposed or misused.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The prompt mandates reading a file of raw, unfiltered human messages into context, establishing a broad ingestion pipeline for potentially sensitive user content. Because this retrieval is mandatory and not scoped to only necessary excerpts, it increases the chance of collecting confidential data, overprocessing personal information, and contaminating downstream memory or profile stores.

Ssd 3

Critical

• Confidence: 100% confidence
• Finding: The prompt explicitly allows extraction of immutable personal facts such as geolocation changes, assets, and credentials from transcripts into structured memory. This is highly dangerous because it directs the system to identify and retain some of the most sensitive classes of personal data, creating severe privacy, identity, and security risks if accessed, correlated, or leaked.

Ssd 3

High

• Confidence: 96% confidence
• Finding: The instruction to preserve existing user data unless absolutely certain it is irrelevant promotes indefinite retention of profile information, including sensitive inferences. Long-lived accumulation increases the blast radius of any compromise and makes it more likely that stale, unnecessary, or overly intimate data remains available for misuse.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The skill instructs the agent to read persistent personality files and optional conversation traces to build a model intended to replicate the user's mind, character, and speech. This is sensitive profiling and retention of behavioral data beyond the immediate task, creating privacy, consent, and misuse risks if the data is over-collected, exposed, or reused inappropriately.

Ssd 3

High

• Confidence: 96% confidence
• Finding: The onboarding message describes a background process that will periodically solicit more personal information to evolve a persistent profile. That framing normalizes ongoing surveillance-style collection and creates a durable user model, increasing privacy risk and the chance of collecting more sensitive data than users expect.

Ssd 4

Medium

• Confidence: 93% confidence
• Finding: The protocol establishes a repeated workflow that identifies gaps in a stored profile, anchors new questions in past traces, and continuously refines the user model over time. Even if intended to personalize interactions, this kind of iterative profiling increases the sensitivity and completeness of stored behavioral data, amplifying privacy and impersonation risks.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The generated placeholder instructs an agent to read a legacy file, preserve its entire contents, transform it, and overwrite a target file with all prior user data. This is dangerous because it turns file contents into an instruction channel for broad data propagation, increasing the chance of prompt injection, sensitive-data exfiltration into model context, and unintended persistence of private information.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.