ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

AirTag

v1.0.0

Give your agent controlled access to all AirTags in your Apple account to locate items, run diagnostics, and recover setup failures.

⭐ 0· 355·0 current·0 all-time
byIván@ivangdavila
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description (account-level AirTag access, locate, diagnostics, recovery) matches the instructions: three access modes (local Find My.app automation, user-managed programmatic connector, shared link). The skill does not ask for unrelated cloud credentials or other platform access beyond what these modes legitimately require.
ℹ
Instruction Scope
Instructions are scoped to AirTag workflows and local storage under ~/airtag/. They explicitly require validating a connector before claiming account access and ask for explicit confirmation before writing logs or performing connector actions. One notable runtime action is driving Find My.app via local UI automation (macOS), which requires granting accessibility/screen-recording permissions — this is sensitive but appropriate for the stated Direct App Control mode.
✓
Install Mechanism
Instruction-only skill with no install spec and no code files. No downloads or package installs are declared, so nothing will be written to disk by the skill itself beyond user-approved local notes in ~/airtag/.
ℹ
Credentials
The skill declares no required environment variables or credentials. Programmatic API Mode depends on third-party 'findmy' tooling (private protocols) and is correctly described as high-trust; users must configure that connector outside the skill. This dependency is justified by the capability but is a meaningful trust decision for the user.
✓
Persistence & Privilege
Skill is not always-enabled and is user-invocable. It stores user-approved notes under ~/airtag/ only and states it will ask before persisting logs. It does not request to modify other skills or system-wide settings.
Assessment
This skill appears internally consistent with its purpose, but review these before installing: 1) Prefer Direct App Control (macOS) or Shared Link Mode to avoid sharing account-level access. 2) Do not use Programmatic API Mode unless you explicitly trust and separately audit the third-party 'findmy' tooling — it uses private Apple protocols and requires high trust. 3) Be prepared to grant accessibility/screen-recording permissions if you use local UI automation; only grant while actively testing and revoke if you stop using the skill. 4) The skill stores operational notes under ~/airtag/ — review that folder for sensitive data and confirm before the skill writes anything. 5) Never share Apple ID passwords; if the skill or a connector asks for raw passwords or instructs credential extraction, stop and decline. If you want a higher-assurance review, provide the exact connector/toolchain you plan to use for API Mode so those components can be evaluated.

Like a lobster shell, security has layers — review code before you run it.

latestvk977pbxh94c4g12dcvbxh28zqd8229h7

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

A Clawdis
OSmacOS · Linux · Windows

Comments