other
Warning
- Location
findmy-location.py:22- Finding
Unnecessary Access to Agent and User State Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Find My Location
Security checks for vulnerabilities and agentic risk
Overview
This skill tracks live Find My locations but has review-worthy privacy and control risks, including possible wrong-contact tracking, full-screen screenshots, and a persistent local click service.
Review carefully before installing. This skill handles precise live location data and screenshots; only use it where the tracked person has intentionally shared their location and you are comfortable granting Accessibility and Screen Recording permissions. Avoid the documented Hammerspoon HTTP click bridge unless it is hardened or removed, and expect screenshots in /tmp to contain more than just the Find My window.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
findmy-location.py:45- Finding
Configured Target Is Ignored, Allowing the Wrong Contact to Be Tracked
- Content
View full analysis
/dev/null') try: win = json.loads(win_json) bounds = win.get('data', {}).get('windows', [{}])[0].get('bounds', [[0, 0]])[0] wx, wy = bounds[0], bounds[1] except: wx, wy = 0, 0 # Click on second row (first shared contact) hsclick = find_hsclick() click_x, click_y = wx + 120, wy + 173 if hsclick: run(f'{hsclick} click {click_x} {click_y}') else: run(f'peekaboo click --coords {click_x},{click_y} --app "Find My" 2>/dev/null') ``` ### Technical Analysis The configured target is loaded into the `target` variable but is never used for contact lookup, UI matching, or identity verification. Instead, the application clicks a fixed point corresponding to an assumed contact row. Contact order can vary based on application state, window layout, account data, recent activity, or UI updates. The fixed click can therefore select a different shared contact than the one authorized or intended by the caller. The application then captures and reports location information without verifying the selected person's identity. ### Attack Path 1. The user configures contact A as the intended target. 2. Contact B appears at the fixed row because of the current Find My ordering or UI layout. 3. The skill calculates `wx + 120, wy + 173` and clicks that position. 4. Find My displays contact B's location. 5. The skill reads accessibili ...[truncated 469 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
findmy-location.py:72- Finding
Full-Screen Capture Exposes Unrelated Sensitive Information
- Content
View full analysis
/dev/null') img = f"/tmp/findmy-{os.getpid()}.png" run(f'peekaboo image --mode screen --screen-index 0 --path {img} 2>/dev/null') result = { "person": None, "address": None, "city": None, "state": None, "status": None, "context": "unknown", "screenshot": img, "needs_vision": False } ``` ### Technical Analysis The skill requests Screen Recording permission for reading Find My but captures the entire primary display using `--mode screen`. This exceeds the minimum scope needed to inspect the Find My window or map. The captured image can include unrelated applications, private messages, credentials, security prompts, notifications, documents, or other personal information visible on the display. The screenshot is stored in the shared temporary directory and its path is returned to callers for potential vision processing. No restrictive file permissions, cleanup process, retention limit, or content redaction is implemented. The PID-based filename reduces accidental collisions but is not a sufficient confidentiality control. ### Attack Path 1. Sensitive information is visible elsewhere on the primary display. 2. The user or an automated Agent invokes `findmy-location`. 3. Peekaboo captures the complete display rather than only the Find My window. 4. The screenshot is written to `/tmp/findmy-.png`. 5. The path is returned in JSON or emitted as `VISION_NEEDED:`. 6. A caller, local process with applicable access, or downstream vision workflow reads unrelated sensitive content from the image. ### Impact Assessment The screenshot can di ...[truncated 395 chars]- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Error
- Location
findmy-location.py:35- Finding
Unverified hsclick Discovery Enables Local Tool Hijacking
- Content
View full analysis
/dev/null') ``` The execution wrapper also invokes all commands through a shell: ```python def run(cmd): return subprocess.run(cmd, shell=True, capture_output=True, text=True).stdout.strip() ``` ### Technical Analysis The application trusts the first existing `hsclick` file in a list of locations without verifying that it is a regular executable, that it is owned by the expected user, that its parent directory is not writable by an untrusted party, or that its content matches an approved implementation. The selected path is interpolated into a command string and executed with `shell=True`. A malicious replacement can therefore execute arbitrary commands under the invoking user's account while appearing to be a legitimate click helper. The highest-priority paths are under the user's home directory and may be writable by other software operating as that user. The issue becomes directly exploitable when an attacker, compromised package, or lower-trust process can plant or replace a file in one of these locations before skill invocation. ### Attack Path 1. An attacker obtains write access to `~/clawd/scripts/hsclick` or another searched location. 2. The ...[truncated 736 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:45- Finding
Documented Hammerspoon Service Accepts Unauthenticated UI-Control Requests
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:28- Finding
Third-Party Dependency Is Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documented behavior involves sensitive location tracking, screenshot capture, and other data handling, but the description does not fully disclose these capabilities or limitations. Mismatches around undeclared data sources, screenshot exposure, and incomplete vision behavior can mislead users about what data is accessed and what protections exist.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented behavior involves sensitive location tracking, screenshot capture, and other data handling, but the description does not fully disclose these capabilities or limitations. Mismatches around undeclared data sources, screenshot exposure, and incomplete vision behavior can mislead users about what data is accessed and what protections exist.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is specifically designed to track another person's real-time location and capture map screenshots containing highly sensitive location data, yet it omits a prominent privacy and consent warning. In this context, under-disclosure is especially dangerous because the capability can facilitate stalking, surveillance, or inadvertent exposure of precise whereabouts.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Using shell=True for a generic command runner in a skill that assembles commands around external tools is a classic parameter-abuse pattern. Any future or current interpolation of environment-controlled values can alter command meaning, execute unintended binaries, or chain extra shell operations, and the sensitive location-tracking context makes compromise more dangerous.
- Content
python } def run(cmd): return subprocess.run(cmd, shell=True, capture_output=True, text=True).stdout.strip() def load_config(): if os.path.exists(CONFIG_PATH):
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Although the code derives a target name, it never uses it to identify the intended contact and instead blindly clicks a fixed row in the Find My UI. In this context, that can track the wrong shared contact and disclose another person's location without authorization, making the privacy impact more severe than a normal functional bug.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill opens Find My, selects a contact, extracts accessibility data, and captures a screenshot without any user-facing warning, confirmation, or consent gate. Because the data involved is live location information, silent collection materially increases surveillance and privacy-abuse risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is explicitly designed to track a shared contact with street-level accuracy and capture screenshots, yet the documentation lacks any meaningful privacy, consent, retention, or lawful-use warning. In this context, the capability is inherently sensitive because it enables surveillance of a real person's movements and collection of location imagery.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README instructs users to run a local HTTP server that accepts arbitrary coordinates and synthesizes mouse clicks anywhere on the desktop. This creates a generic UI automation primitive far broader than the stated skill purpose of location lookup, and any local process able to reach localhost:9090 could trigger unintended actions in other apps under the user's session.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
The README directs users to create a reusable executable in ~/.local/bin that permanently exposes a helper for driving the localhost click service. This increases persistence of the dangerous automation capability beyond a single run, making accidental misuse or abuse by other local processes more likely over time.
- Content
server:start()
text Reload config (Hammerspoon menu → Reload Config), then create `~/.local/bin/hsclick`: ```bash #!/bin/bash curl -s -X POST localhost:9090/click -d "{\"x\":$2,\"y\":$3}"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill documents shell-based installation and execution steps but does not declare any tool scope or permission boundaries. This makes the capability surface opaque to users and agents, increasing the chance the skill is invoked with broader shell access than intended.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The Hammerspoon example starts a local HTTP server that accepts unauthenticated click commands and can synthesize GUI input anywhere on the desktop. Any local process able to reach localhost:9090 could trigger arbitrary clicks, potentially authorizing prompts, changing settings, or interacting with other apps beyond Find My.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
The instructions create a persistent helper script in ~/.local/bin that survives beyond a single run and provides a reusable mechanism to send click commands to the local automation server. Persisting this capability increases the attack window and normalizes long-lived GUI automation infrastructure on the host.
- Content
server:start()
text Reload config (Hammerspoon menu → Reload Config), then create `~/.local/bin/hsclick`: ```bash #!/bin/bash curl -s -X POST localhost:9090/click -d "{\"x\":$2,\"y\":$3}"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Reload config (Hammerspoon menu → Reload Config), then create
~/.local/bin/hsclick:bash #!/bin/bash curl -s -X POST localhost:9090/click -d "{\"x\":$2,\"y\":$3}" chmod +x ~/.local/bin/hsclick
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Reload config (Hammerspoon menu → Reload Config), then create
~/.local/bin/hsclick:bash #!/bin/bash curl -s -X POST localhost:9090/click -d "{\"x\":$2,\"y\":$3}" chmod +x ~/.local/bin/hsclick
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 98% confidence
- Finding
The helper executes arbitrary shell strings with shell=True, and several call sites interpolate values derived from the environment and UI state, such as the discovered hsclick path and screenshot path. In a privacy-sensitive tracking skill, this creates command-injection and command-hijacking risk if those values are manipulated, while also broadening the attack surface of every external tool invocation.
- Content
python } def run(cmd): return subprocess.run(cmd, shell=True, capture_output=True, text=True).stdout.strip() def load_config(): if os.path.exists(CONFIG_PATH):
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill reads unrelated local profile files like USER.md to infer who should be tracked, which is unnecessary implicit data collection outside the declared config. That behavior can leak personal metadata and silently bind the tracking target to information the user did not explicitly authorize for this skill.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description claims street-level accuracy, returns address/city/context, and reads map landmarks with vision fallback for unknown places. In practice, the code does not derive unknown addresses from landmarks or perform any vision analysis; it merely scans accessibility text, matches configured markers, and otherwise marks the result as needing vision with context 'out'.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" BIN_DIR="$HOME/.local/bin" mkdir -p "$BIN_DIR" mkdir -p "$HOME/.config/findmy-location" # Link the script
Static analysis
No suspicious patterns detected.