Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward Windows screenshot skill that captures the primary screen and saves a local PNG when explicitly run.
Install only if you are comfortable with a tool that can capture whatever is visible on your primary Windows screen and save it under .openclaw/media or OPENCLAW_MEDIA_DIR. Review screenshots before sharing them, and delete sensitive captures when no longer needed.
The README instructs users how to run the screenshot tool but does not clearly warn that execution captures the current screen contents and automatically writes a PNG to disk. This can expose sensitive on-screen information and leave persistent image artifacts in the filesystem, increasing the risk of unintended data disclosure in both local and agent-driven workflows.
The user-facing instructions and safety information are presented entirely in Chinese, with no indication that other languages are supported or that the user can choose their preferred language. This can violate a language/locale policy when a skill forces a specific language without opt-in or justification.
The script captures the user's screen and writes the image to disk immediately, without any user-facing notice, consent prompt, or confirmation. In an agent skill context, this can expose sensitive on-screen information such as credentials, personal data, messages, or internal documents, especially if invoked unexpectedly or by another workflow.
The comment at L06 says the environment variable is used for "cross-platform compatibility," but the script relies on System.Windows.Forms and GDI+ screen capture APIs, which are Windows-specific per both the manifest and implementation. In code, $env:OPENCLAW_MEDIA_DIR at L07 only controls where the PNG is saved, not platform compatibility.
No suspicious patterns detected.
