Line Client

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:29 PM UTC
• Version: 0.2.1

Overview

This is a coherent LINE messaging client skill, but it asks the agent to handle private messages and account tokens with too little safety guidance.

Install only if you intend to let the agent operate a LINE account through this client. Protect ~/.line-client/tokens.json and ~/.line-client/sqr_cert as account credentials, keep them out of logs and backups, review the external repository and WASM signer before use, and require explicit confirmation before reading private chats or changing messages, contacts, groups, profile, or settings.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:22
• Finding: LINE Authentication Tokens Stored in a Predictable Plaintext File## Vulnerability Details **File Location**: `SKILL.md`, lines 13 and 22–25 **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: Medium ### Vulnerable Code ```markdown - **Token storage:** `~/.line-client/tokens.json` ``` ```python import json from pathlib import Path from src.chrome_client import LineChromeClient tokens = json.loads((Path.home() / ".line-client" / "tokens.json").read_text()) client = LineChromeClient(auth_token=tokens["auth_token"]) ``` The QR authentication documentation also establishes that the stored material can include an authentication token and refresh token: ```python # result.auth_token, result.mid, result.refresh_token ``` ### Technical Analysis The Skill instructs users to persist and load LINE authentication credentials from the predictable path `~/.line-client/tokens.json`. It does not require restrictive directory or file permissions, an operating-system credential store, encryption at rest, token minimization, output redaction, or secure deletion. Authentication and refresh tokens are sensitive bearer credentials. Any local process or user that can read this file may be able to reuse them without knowing the account password. The predictable path also makes the credentials straightforward to target through malicious local software, overly broad backup jobs, support bundles, or accidental file disclosure. Network access to LINE is necessary for the Skill's declared messaging functionality, and the audited document does not direct credentials to an unrelated endpoint. The security issue is therefore the insufficiently protected local storage of credentials rather than the required transmission to LINE's gateway. ### Attack Path 1. The user completes QR authentication and persists the resulting authentication or refresh token in `~/.line-client/tokens.json`. 2. The file or its parent directory is created with permissions that allow an unintended local user or process to read it, or it is copied ...[truncated 1343 chars]
• Remediation: ## Remediation Suggestions 1. Store authentication and refresh tokens in an operating-system credential manager, such as macOS Keychain, Windows Credential Manager, or Linux Secret Service. 2. If file storage is unavoidable: - Create `~/.line-client` with mode `0700`. - Create `tokens.json` atomically with mode `0600`. - Reject or warn about files owned by another user or accessible by group/other accounts. - Avoid following symbolic links when creating or updating the file. 3. Persist only credentials strictly required for the requested workflow. Avoid storing refresh tokens when short-lived authentication is sufficient. 4. Never print tokens, QR secrets, certificates, or refresh credentials to logs, standard output, exceptions, telemetry, or support bundles. 5. Provide explicit logout, token revocation, rotation, and secure-deletion procedures. 6. Require login PINs and QR authentication material to be delivered only through an explicitly selected, trusted user-facing channel. Do not broadcast them or send them through arbitrary callbacks. 7. Document token lifetime and compromise-response steps, including immediate revocation and reauthentication. 8. Pin and independently audit the referenced external Python, JavaScript, and WASM implementation before entrusting it with account credentials, because those implementation files were not included in the audited artifact.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Credential Access

High

• Category: Privilege Escalation

Content

## HMAC Signing

All API calls require `X-Hmac` header. The WASM signer handles this automatically:
- Derives key from version "3.7.1" + access token via proprietary KDF (in lstm.wasm)
- Signs `path + body` → base64 → `X-Hmac`
- Server mode: ~13ms/sign (Node.js HTTP server on port 18944, auto-started)
- Subprocess mode: ~2s/sign (fallback)

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly documents local storage of authentication tokens and certificates in predictable filesystem locations but does not warn that these artifacts are sensitive credentials that can enable account access if read by other local processes or exposed in logs/backups. In a messaging client context, this creates real account-compromise and privacy risk because the documented workflow encourages direct handling of long-lived auth material.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation advertises extensive capabilities to read messages, enumerate contacts, modify profile/settings, block users, remove chats, and manage groups without any warning about privacy-sensitive or destructive effects. While these are legitimate client features, omitting consent and safety guidance increases the likelihood of misuse, especially when an agent may invoke these operations on behalf of a user.

Static analysis

No suspicious patterns detected.