Security audit
Security checks for vulnerabilities and agentic risk
This is a small Markdown-only skill that explains automatic image understanding and does not include code, persistence, or hidden execution behavior.
Install this only in environments where users understand that images they send may be analyzed by the configured vision model provider or OpenClaw media pipeline. Avoid sending sensitive screenshots, documents, or photos unless those providers and retention settings are acceptable.
The skill advertises automatic image handling across channels and providers but does not disclose that user-supplied images may be transmitted to third-party model vendors or a fallback media-processing pipeline. This creates a real privacy and consent risk because users may send sensitive screenshots, documents, or photos without understanding where that data is processed or retained.
The usage examples show the agent responding in Chinese, but the skill description does not explain that responses are locale-specific or optional. This can violate language/locale policy expectations because it implies a fixed response language without user opt-in.
No suspicious patterns detected.
