ClawHub
Back to skill

Security audit

Location Awareness

Security checks across malware telemetry and agentic risk

Overview

This is a coherent location skill, but it handles precise location and credentials with enough under-disclosed third-party sharing and broad environment loading to merit careful review.

Install only if you are comfortable with a skill accessing precise location, saved places, movement history, and location-provider tokens. Use a dedicated minimal token/configuration, avoid putting unrelated secrets in ~/.openclaw/.env, and treat ETA, address lookup, nearby search, and notifications as features that can reveal location data to external services or channels.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill clearly instructs execution of a shell script that reads environment variables, writes persistent data such as geofences/reminders, and contacts network services, yet no permissions are declared. This creates a capability/expectation mismatch that can bypass user or platform review and increases the risk of sensitive location data being accessed, stored, or transmitted without explicit consent.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The skill sends precise coordinates to third-party services (Nominatim for reverse geocoding) despite being described as 'privacy-friendly GPS tracking.' That creates a real privacy disclosure issue because users may reasonably expect location processing to remain local or limited to their configured provider, while exact location is additionally disclosed to external infrastructure.

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The ETA feature transmits origin and destination coordinates to the public OSRM routing service over plain HTTP, which both expands third-party exposure and weakens transport confidentiality. This is inconsistent with the skill's privacy-friendly framing and leaks precise movement data to external parties and potentially network observers.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The wrapper implicitly sources a global $HOME/.openclaw/.env file and exports all variables into the child process, granting location.py access to credentials not clearly required by a simple launcher. Because shell source executes the file as code rather than parsing key/value pairs safely, a compromised or unexpected .env file can also inject arbitrary commands during wrapper execution.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill advertises status, coordinate, address, history, and proximity features without warning that outputs may reveal precise addresses and movement history. In a location-tracking skill, this context makes the omission more serious because users may unknowingly expose highly sensitive physical-location data in chat logs, notifications, or shared agent sessions.

Missing User Warnings

Medium
Confidence
80% confidence
Finding
The documented deletion command removes saved places/geofences without any user-facing caution or confirmation guidance. Because saved places may drive reminders and automation, accidental or induced deletion could silently disrupt safety- or routine-related behavior and erase sensitive configuration.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The add-place command persists the user's current location as a named place, but the instructions do not warn that this stores sensitive location data long-term. In a location-awareness skill, persistence of home/work/frequent places materially raises privacy risk if files, backups, or later outputs are exposed.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The automatic notification example sends triggered location events to an external messaging channel but omits any privacy warning about transmitting location-derived data off-platform. This is more dangerous in context because reminders, proximity alerts, and geofence actions can reveal presence at specific places or movement patterns to third-party services or unintended recipients.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
Precise location data is sent to external geocoding services without any user-facing warning, consent flow, or clear disclosure. In a location-awareness skill, silent transmission of latitude/longitude to third parties materially increases privacy risk because it can reveal home, work, routines, and travel history.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The script silently loads sensitive Home Assistant credentials without any user-facing disclosure, which increases the risk of users invoking the skill without understanding that secrets will be imported into the process environment. In a location-tracking skill, those credentials can expose both home automation access and sensitive movement data if downstream code logs, transmits, or misuses them.

Credential Access

High
Category
Privilege Escalation
Content
#!/bin/bash
# Location awareness wrapper - loads credentials and runs location.py

# Source OpenClaw .env if available (provides HA_URL, HA_TOKEN, etc.)
[[ -f "$HOME/.openclaw/.env" ]] && set -a && source "$HOME/.openclaw/.env" && set +a

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
Confidence
89% confidence
Finding
.env

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.