Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
FaceTime Auto Call
v1.0.0Make FaceTime audio/video calls via AppleScript. Automatically handles notification clicking with multi-depth fallback. Use when user wants to call someone o...
⭐ 0· 71·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the provided scripts: call.sh opens facetime:// URLs and uses AppleScript to click notification buttons; setup.sh creates a local NodeRunner.app wrapper to get Accessibility permissions. All requested artifacts (none external) are coherent with automating FaceTime calls.
Instruction Scope
Instructions correctly require granting Accessibility permission and running setup.sh. The runtime AppleScript explicitly reads Contacts (for find-contact) and interacts with Notification Center (to click call-confirm buttons and to clear notifications). This behavior is expected for the stated functionality, but it does involve access to sensitive UI and contact data.
Install Mechanism
No remote install/downloads or package installs are performed. setup.sh creates a local ~/Applications/NodeRunner.app wrapper and Info.plist—this is a local file creation only. No remote code execution or obscure URLs are used.
Credentials
The skill does not request environment variables, keys, or other credentials. It does, however, require macOS Accessibility authorization so the scripts can control the UI and will read Contacts via AppleScript—these are proportionate to contact lookup and notification-clicking features but are sensitive capabilities to grant.
Persistence & Privilege
The skill is not always-enabled and does not modify other skills. It does create a persistent NodeRunner.app in ~/Applications which remains until removed; granting Accessibility to that app yields long-lived UI control privileges. This persistence is reasonable for the tool's operation but increases the blast radius if misused.
Assessment
This skill appears to do what it says, but it requires macOS Accessibility permission and will interact with Notification Center and your Contacts. Before installing: (1) review the three included scripts locally so you understand what will be created and run; (2) note setup.sh creates ~/Applications/NodeRunner.app that will persist and you must manually grant Accessibility to it — doing so allows the app to control the UI; (3) if you only need one-off calls consider running call.sh directly (and avoid granting persistent Accessibility) or run in a dedicated macOS account; (4) confirm /opt/homebrew/bin/node exists or edit NodeRunner wrapper accordingly; (5) avoid installing if you cannot or do not want to grant UI control or Contacts access. If you want higher assurance, run the scripts in a disposable account or inspect them line-by-line before granting permissions.Like a lobster shell, security has layers — review code before you run it.
latestvk97dhs4m79njkpma3v6vnys5b983m4tq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.