Give eyes to your openclaw

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:19 AM UTC
• Version: 1.0.1

Overview

The skill is a disclosed screen and audio capture helper, but it needs review because its capture guidance is broad and it installs an unpinned third-party package that handles sensitive data.

Install only if you trust the `eye2byte` package source and are comfortable with local screen, audio, transcript, and recent-context storage. Before using it, prefer explicit per-capture consent, choose a specific window or region when possible, avoid all-monitor capture unless needed, and treat `EYE2BYTE_MCP_TOKEN` as a secret.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19
• Finding: Unpinned Third-Party Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 19-22 **Vulnerability Type**: Unpinned and unverifiable third-party dependency **Risk Level**: Medium ```yaml install: - kind: uv package: eye2byte bins: [eye2byte] ``` ### Technical Analysis The skill directs the package manager to install `eye2byte` without specifying an exact version, cryptographic hashes, or an immutable source revision. The repository also contains no dependency lockfile or package source that would allow the installed implementation to be audited as part of this artifact. Consequently, the code installed when the skill is deployed may differ from the code reviewed or expected by the skill author. The declared skill version (`0.3.1`) does not constrain the version resolved by the installation entry. This creates a supply-chain risk if the package publisher account, package registry, release process, or dependency resolution process is compromised. Because Eye2byte's declared functionality includes access to screenshots, screen recordings, voice recordings, transcriptions, and an MCP bearer token, a compromised package could potentially access particularly sensitive user information. ### Attack Path 1. An attacker compromises the `eye2byte` package publication process, its registry account, or another component involved in dependency resolution. 2. The attacker publishes a malicious release under the package name expected by the unpinned installation configuration. 3. A user installs or updates the skill after the malicious release becomes resolvable. 4. The `uv` installation process retrieves the attacker-controlled package because no exact version or artifact hash is enforced. 5. Malicious installation-time or runtime code executes with the privileges of the user running the installation or MCP server. 6. The malicious code may access files and process resources available to that user, including captured screen or audio data and environment-provided ...[truncated 879 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `eye2byte` to an explicitly reviewed version rather than resolving the latest available release. 2. Require cryptographic hashes for the package artifact and reject installations whose hashes do not match. 3. Include a reviewed lockfile that fixes all transitive dependency versions and integrity information. 4. Prefer an immutable, provenance-verifiable artifact or source revision. 5. Verify package publisher identity, release signatures, and build provenance before approving upgrades. 6. Review the package source and dependency changes whenever the pinned version or hashes are updated. 7. Run the MCP server with least privilege and restrict its filesystem and network access to what its declared functionality requires. 8. Limit secret exposure by providing `EYE2BYTE_MCP_TOKEN` only to the required process and rotating it if package compromise is suspected. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The example trigger phrases are broad enough that an agent could interpret ordinary conversation such as 'look at my screen' or 'check this' as authorization to capture screenshots. Because this skill can access highly sensitive visual data across one or all monitors, accidental invocation can expose secrets, personal data, or unrelated work context without sufficiently explicit consent at the moment of capture.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The 'When to Use' guidance encourages invocation based on vague conditions like visual mentions, monitoring requests, or verifying changes, which can cause the agent to initiate screen capture without strong, transaction-specific user consent. In this context the danger is elevated because the tool can capture full desktops, specific windows, or all monitors, making overcollection of sensitive information likely if activation criteria are loosely interpreted.

Static analysis

No suspicious patterns detected.