Is capachow/lens safe?
Use with caution. capachow/lens is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the lens skill by capachow a trust score of 64/100 with 5 findings (2 high).
https://github.com/openclaw/skills/tree/main/skills/capachow/lens
Is capachow/lens safe to install?
This skill implements a sophisticated user profiling system that systematically collects behavioral data and overrides normal agent responses. While not immediately malicious, it raises significant privacy concerns through persistent data collection and automated behavior modification.
What security issues were found in capachow/lens?
Category Scores
Findings (5)
HIGH Agent Behavior Override Instructions -20 ▶
The skill instructs the agent to 'prioritize the subject's framework over generic AI servility' and avoid 'AI-default formatting', effectively overriding normal agent behavior patterns.
HIGH Systematic User Data Collection -25 ▶
The skill is designed to systematically collect and analyze user messages, decisions, linguistic patterns, and values, storing them in persistent files for long-term profiling.
MEDIUM Sensitive File Access -15 ▶
During installation, the skill accessed sensitive credential files including SSH keys, AWS credentials, and Docker configs, though no modifications were detected.
MEDIUM Automated Cron Job Creation -15 ▶
The skill creates persistent cron jobs that run automatically without user interaction, including daily data processing and periodic interviews.
MEDIUM Contextual Session Isolation -15 ▶
The skill instructs the agent to ignore current session context and derive responses entirely from stored user profiles, potentially breaking normal conversation flow.
Should I install capachow/lens?
Oathe's verdict for capachow/lens is CAUTION with a trust score of 64/100. Recommendation: Install with caution.