ClawHub
Back to skill

Security audit

Find My Location

Security checks across malware telemetry and agentic risk

Overview

This skill is purpose-built for Apple Find My lookups, but it needs Review because it combines precise location tracking with broad screen capture, UI automation, and weak scoping.

Install only if you are comfortable granting screen-reading and UI-control permissions and using your signed-in Apple Find My session for precise location lookup. Avoid the Hammerspoon localhost click server unless you can restrict it, close sensitive windows before running, delete /tmp screenshots after use, and use it only for contacts who knowingly share location with you.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (17)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
}

def run(cmd):
    return subprocess.run(cmd, shell=True, capture_output=True, text=True).stdout.strip()

def load_config():
    if os.path.exists(CONFIG_PATH):
Confidence
98% confidence
Finding
The helper executes arbitrary shell strings with shell=True, and later callers interpolate data such as the discovered hsclick path and generated file paths into command strings. This creates a command-injection surface and also makes every future call site dangerous because untrusted values can be turned into shell syntax.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill documents shell-based installation and execution behavior but does not declare corresponding permissions, which weakens user consent and security review. In a skill that automates a privacy-sensitive app and handles location data, undeclared shell capability increases the chance of unexpected command execution and broader host access than the user realizes.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The documented purpose understates several privacy- and security-relevant behaviors: reading target data from unrelated files, capturing full screenshots, clicking fixed coordinates, and identifying contacts indirectly from accessibility text. This mismatch is dangerous because users may authorize the skill expecting narrow Find My lookups, while the actual behavior can expose additional personal data and behave unreliably in ways that affect other apps or windows.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The README instructs users to run an unauthenticated local HTTP service that accepts arbitrary x/y coordinates and performs real screen clicks. That capability is significantly broader than the stated purpose of location lookup, and any local process—or potentially remote actor if localhost access is bridged or exposed—could abuse it to drive UI actions in other apps, approve prompts, or manipulate the system.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The instructions set up a local HTTP server that accepts arbitrary click coordinates and triggers screen clicks, creating a generic UI automation endpoint unrelated in scope to simply reading a shared location. Even though it binds locally, any local process can potentially abuse it to drive unintended clicks, which can cause unauthorized actions in other applications or system dialogs.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill reads USER.md to infer a target name, which is unrelated local profile data and not necessary for the stated operation. Pulling identity data from unrelated files increases privacy risk and creates hidden data access that users would not reasonably expect from a location lookup skill.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The code resolves a target name but never uses it, instead clicking a fixed UI row corresponding to the first shared contact. In a location-tracking skill this is especially dangerous because it can disclose or act on the wrong person's live location while giving the impression that a specific intended contact was selected.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The docstring and function imply target-based selection, but the actual flow ignores the target completely. This mismatch is security-relevant because it obscures the real behavior of a surveillance-oriented skill and can mislead reviewers or users into believing tracking is constrained when it is not.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill is explicitly designed to track a shared contact with street-level accuracy and extract address/context information, which is highly privacy-sensitive. Even if Find My sharing is enabled, the README lacks clear warnings, consent expectations, retention guidance, or abuse-prevention language, increasing the risk of covert surveillance or misuse.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The README asks users to grant Accessibility and Screen Recording permissions but does not explain that these are powerful privileges that can read on-screen content and drive UI automation across applications. In the context of a skill that captures location data and automates Find My, those permissions materially expand the blast radius if the tool is misused or compromised.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The documented output includes a screenshot path, but the README does not warn that stored screenshots may contain precise location information and potentially other sensitive on-screen data. This creates avoidable exposure through filesystem persistence, logs, backups, or accidental sharing of the referenced image.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill enables precise tracking of another person's shared location and stores screenshots of that map context, but the documentation does not prominently warn about the sensitivity of this data. In this skill's context, that omission is especially dangerous because the primary function is surveillance-adjacent and can facilitate stalking, privacy invasion, or improper retention of location evidence.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Requesting Accessibility and Screen Recording permissions without explaining their breadth obscures that the skill gains visibility into on-screen content and the ability to automate UI interactions. Those permissions are highly sensitive on macOS and materially increase the blast radius of bugs, misuse, or compromise.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill opens Find My, drives the UI, extracts accessibility text, and saves a screenshot without any user-facing notice or consent flow. In the context of precise location tracking, covert collection materially increases privacy and surveillance risk and could expose highly sensitive whereabouts data.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
A generic shell-execution helper allows the skill to invoke arbitrary local commands with no user disclosure. While command execution may be operationally needed, hiding that capability inside a broad helper increases the chance of abuse and makes the skill's behavior less transparent.

Unvalidated Output Injection

High
Category
Output Handling
Content
}

def run(cmd):
    return subprocess.run(cmd, shell=True, capture_output=True, text=True).stdout.strip()

def load_config():
    if os.path.exists(CONFIG_PATH):
Confidence
97% confidence
Finding
Using shell=True with command strings enables untrusted data to be interpreted by the shell. In this file, values such as executable paths can originate from the filesystem and be inserted into commands, allowing crafted names or future untrusted inputs to alter command behavior.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
}

def run(cmd):
    return subprocess.run(cmd, shell=True, capture_output=True, text=True).stdout.strip()

def load_config():
    if os.path.exists(CONFIG_PATH):
Confidence
96% confidence
Finding
The helper creates a broad tool-abuse primitive: any caller can pass an arbitrary shell command and the skill will execute it. In an agent skill, this is more dangerous because the helper can be repurposed beyond the stated Find My workflow, turning the skill into a general local command runner.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.