Privacy Mask

Mask, redact, anonymize and censor sensitive information (PII) in screenshots and images — phone numbers, emails, IDs, API keys, crypto wallets, credit cards...

This skill is plausibly what it says (local image PII masking), but there are a few red flags to check before installing/enabling it: 1) The skill's hooks reference scripts/mask-images.sh and intercepting the agent's local image cache, but no script or code files are bundled — ask the publisher where that hook implementation lives or provide the script so you can inspect it. 2) Confirm what 'in-place' interception actually does: the SKILL.md warns not to modify originals by default, yet the hook text says it applies masking in-place — ensure the hook will not silently overwrite originals unless you explicitly request that. 3) Vet the privacy-mask CLI package before pip installing (review source code, repository trust, and the PyPI package name) because pip install downloads and runs third-party code. 4) Test the tool with non-sensitive sample images and run --dry-run first to verify detections and outputs. 5) If you plan to allow automatic interception, limit its scope (only explicit user-submitted images) and ensure logs/notifications are produced when files are modified. If you cannot verify the hook implementation or the privacy-mask package source, treat enabling the automatic hook as higher risk.

Type: OpenClaw Skill Name: privacy-mask Version: 0.3.5 The 'privacy-mask' skill is a privacy-focused tool designed to redact PII from images locally using OCR and regex-based detection. It utilizes the 'UserPromptSubmit' hook to intercept and sanitize images in the local cache before they are sent to an LLM API, which aligns with its stated purpose of data loss prevention (DLP). The instructions in SKILL.md explicitly guide the agent to prioritize user privacy and local processing, and there is no evidence of data exfiltration, malicious execution, or harmful prompt injection in the provided files.