Find My

• Analyzed: May 12, 2026, 1:23 AM
• Findings: 1
• Version: 0.1.2
• Hash: a2c21e9b3a4606ccbb286c0476191aeeede77a801d2afd9c640e5c649bd99b30
• Source: palm
• External report: View on VirusTotal

Findings (1)

Package: findmy-cli (npm) Version: 0.1.2 Description: OpenClaw plugin for macOS Find My friend locations. Shells out to the findmy CLI to drive FindMy.app via screen capture and Vision OCR. macOS-only. Install findmy first via `brew install omarshahine/tap/findmy-cli`. This package is a secure wrapper designed to execute a required, external, macOS-specific binary (`findmy`) for querying friend locations via Find My application screen scraping (OCR). The code mitigates common risks associated with external execution: 1. **Injection Prevention:** It exclusively uses `child_process.execFile` (or `promisify(execFile)`) to run the external binary, ensuring arguments are passed as a token array and avoiding shell interpretation. 2. **Input Sanitization:** The `findmy_person` tool input (`name`) is strictly validated (`validateName` function) against a character allowlist, length limits, and null checks, further preventing malicious command injection attempts even if the executed binary were somehow vulnerable to specialized argument parsing. While the underlying operation requires significant permissions (macOS Screen Recording) and involves potentially intrusive behavior (UI scraping), this necessity is fully documented, and the wrapper code itself adheres to best security practices for executing untrusted binaries.