ClawHub
Back to skill

Security audit

Camera Capture

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it uses the local webcam to preview or save photos, with no evidence of hidden networking or unrelated data access.

Install only if you are comfortable allowing an agent to access your local webcam when asked. Captured images may contain sensitive surroundings and are saved locally, so review or delete files in ~/.openclaw/workspace/captures/ as needed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
This skill enables direct access to the local built-in camera for capture and preview, but the user-facing description and usage guidance do not clearly warn about privacy implications, consent, or that images from the physical environment may be recorded and stored. In an agent setting, this omission increases the risk of unexpected surveillance-like behavior or accidental collection of sensitive visual data from the user’s surroundings.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The capture function saves a camera image to disk automatically and only prints the resulting file path after the write occurs; it does not provide a clear user-facing warning, confirmation step, or consent mechanism before creating a persistent image. In a skill that controls a local built-in camera, this is privacy-sensitive behavior because it enables silent collection and retention of webcam photos, increasing the risk of covert surveillance or later exfiltration by other components.

Static analysis

No suspicious patterns detected.