Find My
ReviewAudited by ClawScan on May 1, 2026.
Overview
This skill appears purpose-aligned and local-only, but it handles sensitive Find My location data through macOS UI automation and saves local screenshots.
This skill does not show evidence of hidden networking, credential theft, or malicious code. Before installing, be comfortable granting UI automation access to Find My, letting the agent view sensitive location information, and managing local screenshot files that may contain names, maps, and addresses.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may be able to see locations for your devices, AirTags, family members, and friends who share location with you.
The skill intentionally uses broad macOS UI permissions and the already-signed-in Find My app to view sensitive account-linked location data.
OpenClaw.app needs Screen Recording + Accessibility permissions ... Location data for people, devices, and items in your Find My app
Install only if you want the agent to access Find My location information, and review macOS Accessibility and Screen Recording permissions regularly.
A mistaken position or coordinate could select the wrong person, device, or item, or activate a visible Find My control unintentionally.
The skill exposes coordinate-based UI automation and an action that can trigger a Find My item sound. This is disclosed and purpose-aligned, but coordinate automation can click the wrong control if the UI layout changes.
`fm-click.sh <x> <y>` | Click at relative window coords ... `fm-play-sound.sh <pos>` | Attempt to play sound on item
Watch the screen while the skill runs, confirm item positions before actions like Play Sound, and avoid using manual coordinate clicks unless necessary.
Sensitive location screenshots may remain on disk and be visible to anyone or any process with access to those files.
The skill saves screenshots that may include maps, addresses, names, and location status. These files persist locally after the command finishes.
Screenshots of the Find My window (stored locally in `/tmp/`)
Use a private output directory when possible, avoid sharing screenshot paths, and delete Find My screenshots after use.
Install-time checks may not warn users about the real local permissions and tools needed before they read the skill documentation.
The registry metadata does not reflect the macOS-only requirement and helper dependencies that SKILL.md declares, such as Peekaboo, jq, and the OpenClaw bridge socket.
OS restriction: none ... Required binaries (all must exist): none ... Env var declarations: none
The publisher should align registry metadata with SKILL.md by declaring macOS, required binaries, bridge configuration, and privacy-relevant capabilities.