Is edenjw/pocket-lens safe?
Use with caution. edenjw/pocket-lens is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the pocket-lens skill by edenjw a trust score of 80/100 with 3 findings (1 high).
https://github.com/openclaw/skills/tree/main/skills/edenjw/pocket-lens
Is edenjw/pocket-lens safe to install?
The PocketLens skill provides legitimate expense tracking functionality but handles highly sensitive financial data that is transmitted to external services. While no malicious behavior was detected during installation, the skill inherently creates privacy and security risks due to the nature of financial data it processes and transmits.
What security issues were found in edenjw/pocket-lens?
Category Scores
Findings (3)
HIGH Sensitive Financial Data Transmission -40 ▶
The skill's core functionality involves extracting sensitive financial information from receipts and card statements (amounts, merchant names, card details, dates) and transmitting this data to an external service at pocketlens.app. This creates significant privacy risks as users' complete spending patterns and financial behavior are exposed to a third-party service.
MEDIUM Executable Script with User Data Processing -25 ▶
The skill includes a Node.js script (pocket-lens.mjs) that processes user-controlled JSON data for API interactions. While appearing legitimate, executable scripts always present potential attack vectors if input validation is insufficient.
LOW External Service Dependency Risk -35 ▶
The skill creates a dependency on an external service (pocketlens.app) for core functionality. If this service is compromised, becomes malicious, or has data breaches, all user financial data could be at risk. Users have no control over how this external service handles their sensitive information.
Should I install edenjw/pocket-lens?
Oathe's verdict for edenjw/pocket-lens is CAUTION with a trust score of 80/100. Recommendation: Install with caution.