sam-faces

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:21 AM UTC
• Version: 1.1.0

Overview

The skill is openly a local face-recognition tool, but it automatically identifies people in any shared image and stores face data without clear opt-in, retention, or cleanup controls.

Install only if you are comfortable with automatic local face identification for images you share, persistent storage of known and unknown face data in the workspace, and a mutable PyPI dependency. Prefer using it only in private workspaces, get consent for people being enrolled or identified, and periodically inspect and delete the faces database and unknown-crops directory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:13

Finding

Unpinned Third-Party Executable Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–23
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code Snippet:

yaml

"openclaw":
  {
    "emoji": "👤",
    "requires": { "bins": ["sam-faces"] },
    "install":
      [
        {
          "id": "pip",
          "kind": "pip",
          "package": "sam-faces",
          "bins": ["sam-faces"],
          "label": "Install sam-faces from PyPI",
        },
      ],
  },

Related installation instructions at lines 50–58:

bash

pip install sam-faces

Or use the OpenClaw skill installer:

bash

openclaw skills install sam-faces

Technical Analysis

The Skill installs and executes the sam-faces package from PyPI without specifying an exact version, package hash, signature, lockfile, or other integrity constraint. The external package supplies the executable that processes user images and writes data within the workspace.

Because the dependency source is not included in the audited project, its implementation and the documentation claim that all processing remains local cannot be verified from this artifact. An unpinned dependency can also change after the Skill has been reviewed, causing later installations to execute code that differs from the reviewed behavior.

This finding does not establish that the current PyPI package is malicious. It identifies a supply-chain weakness that would permit a compromised publisher account, distribution channel, or future package release to introduce arbitrary executable behavior.

Attack Path

1. An attacker compromises the package publisher, package distribution account, or another relevant supply-chain component.
2. The attacker publishes a modified release under the expected sam-faces package name.
3. A user or OpenClaw installer runs the documented installation command without a version or hash constraint.
4. The p ...[truncated 876 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specifically reviewed version rather than installing the latest available release.
• Require cryptographic package hashes through a locked requirements file or an equivalent verified installation mechanism.
• Include audited source code in the project or link to an immutable source revision used to build the package.
• Verify package publisher identity, provenance, release signatures, and distribution metadata.
• Use reproducible builds and compare generated artifacts with trusted release hashes.
• Run the executable in a sandbox with network access disabled unless explicitly required.
• Restrict filesystem access to the specific input image, temporary directory, and face database required for the operation.
• Perform recurring dependency review and vulnerability scanning before updating the pinned release.

other

Warning

• Location: SKILL.md:32

Finding

Automatic Biometric Processing and Persistent Face-Data Retention Without Explicit Consent

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32–47
Vulnerability Type: other: Biometric Privacy and Data Retention Risk
Risk Level: Medium

Vulnerable Code Snippet:

markdown

**When the user intentionally sends a photo or image to the assistant:**

The user sharing an image with their AI colleague is an act of intentional
sharing — they want the assistant to see and understand what's in the image.
In this context, face identification should happen automatically as part of
understanding the image content.

1. Save the image to a temp path.
2. Run face identification: `sam-faces identify <path>`
3. Parse the JSON response.
4. If `face_count > 0`, prepend `llm_context` to your image description.
5. If any face has `"unknown": true`, ask the user who they are, then offer
to enroll them.

The related persistent-storage behavior is documented at lines 131–135:

markdown

- All inference runs locally via `face_recognition` (dlib). Nothing leaves the machine.
- Database: `{workspaceDir}/faces/people.db`
- Unknown face crops saved to: `{workspaceDir}/faces/unknown/`
- Works with existing face databases — no migration needed.

Technical Analysis

The Skill treats submission of an image as implicit authorization to perform face identification automatically. General image sharing does not necessarily establish informed consent for biometric identification, especially for third parties depicted in the image.

The instructions also state that unknown face crops are stored in the workspace. They do not define an opt-in requirement, retention period, automatic deletion policy, encryption requirement, access-control policy, or procedure for reviewing and purging stored biometric information. The temporary-image instruction similarly does not require secure temporary-file creation or guaranteed cleanup.

Facial images, identity labels, and derived face encodings are se ...[truncated 1495 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, informed opt-in before performing facial identification rather than inferring consent from image submission.
• Explain what biometric information will be processed, where it will be stored, and how long it will be retained.
• Account for third-party faces and avoid identification where appropriate consent or another valid authorization is absent.
• Disable storage of unknown face crops by default and require a separate explicit action to retain them.
• Implement configurable retention periods and automatic deletion for temporary images, unknown crops, encodings, and identity labels.
• Provide commands or interfaces to inspect, delete, and purge all retained biometric data.
• Create temporary files using secure, unpredictable names with restrictive permissions and guarantee deletion through cleanup handling.
• Encrypt persistent biometric records at rest and restrict access to the minimum required account and process.
• Prevent biometric directories from being included in broad backups or logs unless explicitly authorized and appropriately protected.
• Treat llm_context returned by the external executable as untrusted data; delimit and validate it before including it in an LLM prompt.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs the agent to perform face identification automatically whenever a user sends an image, but it does not require a clear consent step or privacy warning before processing biometric data. Because face recognition and identity inference are highly sensitive, silently turning shared images into identified-person context increases the chance of collecting and using identity data beyond what the user expected.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill frames any user-shared image as implied consent for automatic face identification, which is too broad for biometric processing. A user may want general image understanding without identity recognition, and normalizing automatic identification can lead to unnecessary collection and disclosure of sensitive biometric and identity data.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to prepend llm_context to the prompt automatically injects identified names, confidence scores, and location metadata into downstream LLM context whether or not that identity data is necessary for the user's request. This broadens dissemination of sensitive personal information inside the assistant workflow and can cause overexposure, logging, or secondary use of identity data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The notes mention that unknown face crops are saved to {workspaceDir}/faces/unknown/, but the skill does not surface this as a prominent warning in the operational flow where users would understand that images of unidentified people will be retained on disk. Storing cropped faces creates a sensitive biometric data store and can surprise users or expose private data if the workspace is shared or later compromised.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.