clawlens

• Analyzed: May 11, 2026, 6:58 AM
• Findings: 1
• Version: 1.0.5
• Hash: 3aa6eb1dacf9cffa0b0e6d532f769ce4d7ac6cecf35e1e60b8c7139b5aa1985b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill requires high-privilege access to the OpenClaw environment, specifically reading all historical conversation logs and extracting plaintext API keys or OAuth tokens from 'auth-profiles.json' (scripts/clawlens.py). It transmits truncated conversation transcripts to external LLM providers via litellm to perform 'facet extraction' and report generation. While these actions are documented in SKILL.md and aligned with the stated purpose of providing usage insights, the automated extraction of credentials and bulk exfiltration of private chat history to third-party APIs constitutes a significant security and privacy risk.