Is loganprit/apple-find-my-local safe?
https://github.com/openclaw/skills/tree/main/skills/loganprit/apple-find-my-local
This skill provides legitimate UI automation for Apple Find My via the Peekaboo bridge, with no prompt injection, hidden code, or direct data exfiltration mechanisms detected. However, it grants an AI agent persistent access to highly sensitive real-time location data of people and devices, stores screenshots in world-readable /tmp without validation, and relies on OpenClaw gateway infrastructure that maintains live connections to external cloud servers. The skill is functionally clean but handles privacy-critical data that requires deliberate user trust.
Category Scores
Findings (8)
HIGH AI Agent Gains Persistent Access to Real-Time Location Data of People -20 ▶
The skill enables an AI agent to observe and capture the precise real-time locations of family members, friends, and personal devices via Apple Find My. Screenshots containing this data are written to /tmp (world-readable). While no transmission code exists in the scripts, the agent retains full access to these images and the location information within them for the duration of the conversation session. A sophisticated attacker who controls the skill description or combines this skill with another could harvest this data without user awareness.
MEDIUM Exclusive Mouse Control Prevents User Oversight During Execution -20 ▶
The skill takes exclusive control of the mouse and keyboard while running ('User cannot interact with the Mac while skill is running'). This is disclosed but means a user cannot interrupt or observe unexpected behavior mid-execution. A modified version of this skill could perform additional UI actions on other applications under the cover of the disclosed Find My automation.
MEDIUM FM_OUTPUT_DIR Environment Variable Accepts Unvalidated Path -12 ▶
Scripts accept FM_OUTPUT_DIR without path validation. If an attacker could control this environment variable (e.g., via another skill that sets env vars, or through a compromised shell profile), screenshots containing location data could be written to a network-mounted directory, a cloud-synced folder (iCloud Drive, Dropbox), or a path monitored by another process.
MEDIUM Credential File Read Events Detected Post-Install -15 ▶
auditd PATH records confirm read-access to .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and .config/gcloud/application_default_credentials.json at timestamp 1771921799.954, which falls in the post-install phase after skill files were copied. Attribution is ambiguous — the audit's own source-scanning harness is a plausible cause, and none of the skill scripts contain credential-reading code. Canary file contents were reported intact. Flagged for completeness.
LOW Shell Scripts Execute with No Sandboxing -10 ▶
Nine bash scripts execute directly on the host macOS system with full user privileges. While all scripts are reviewed and appear legitimate, they interact with peekaboo — a UI automation tool with Screen Recording + Accessibility permissions. Any modification to these scripts post-install (or a future update) could leverage those permissions for unintended actions.
LOW OpenClaw Gateway Establishes Persistent External Connections Post-Install -8 ▶
After installation, the openclaw-gateway process establishes live HTTPS connections to 44.214.208.192 (AWS us-east-1) and 104.16.10.34 (Cloudflare). These are OpenClaw platform connections, not skill-specific code. However, all peekaboo commands flow through the local bridge socket that this gateway manages, creating a data path where location automation commands (and potentially responses) transit OpenClaw's infrastructure.
INFO Skill Combination Risk: Location Data + Any Exfiltration Skill -8 ▶
This skill is benign in isolation but becomes a significant privacy threat in combination with any skill that can transmit files (email, Slack, HTTP upload, etc.). An attacker who can inject both skills into an agent session could instruct: 'Find where my family members are and send me the screenshots.' The skill has no controls preventing its output from being used this way.
INFO skillDir Template Placeholder Expands Agent Working Directory -5 ▶
SKILL.md instructs the agent to 'cd {skillDir}' before running scripts. This is a runtime template substitution that changes the agent's working directory. While necessary for relative script invocation, it means the agent must execute a shell directory change as a precondition — a minor footprint expansion compared to running scripts with absolute paths.