T09 · Insecure Skill Coding Practices
Error
- Location
scripts/send-message.sh:27- Finding
Arbitrary Code Execution Through Unsafe Secrets Loading and Python Source Interpolation
- Content
View full analysis
- Remediation
View remediation
Security audit
GroupMe
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its GroupMe messaging purpose, but its helper script handles secrets unsafely enough to warrant review before installation.
Review this before installing. Use a dedicated low-privilege GroupMe bot/token, restrict the secrets file permissions, avoid putting tokens in command lines or logs, and do not run the helper from cron until the secrets loading and Python interpolation issues are fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/send-message.sh:63- Finding
GroupMe Access Token Exposed in URL Arguments and Required Beyond the Sending Operation's Needs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (27)
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
md ## What You Get - Send messages to your GroupMe group on-demand or on a schedule - Automate shift reminders, announcements, and alerts via cron - Broadcast urgent messages instantly - Perfect for teams, clubs, families, or any group
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### 1. Get Your GroupMe Access Token Go to https://dev.groupme.com/bots and copy your access token (shown at the top of the page). ### 2. Create a Bot
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### 1. Get Your GroupMe Access Token Go to https://dev.groupme.com/bots and copy your access token (shown at the top of the page). ### 2. Create a Bot
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### 1. Get Your GroupMe Access Token Go to https://dev.groupme.com/bots and copy your access token (shown at the top of the page). ### 2. Create a Bot
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh ### 1. Get Your GroupMe Access Token Go to https://dev.groupme.com/bots and copy your access token (shown at the top of the page). ### 2. Create a Bot
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The example
curlcommand places the access token directly in the URL query string. Tokens in URLs are prone to leakage via shell history, terminal scrollback, process inspection, proxy logs, browser or tooling history, and other telemetry, making credential exposure more likely.- Content
3. Find Your Group ID
Open a terminal and run (replace
YOUR_TOKENwith your access token):bash curl -s "https://api.groupme.com/v3/groups?token=YOUR_TOKEN&per_page=10"
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
md --- name: groupme description: "Bridge OpenClaw to GroupMe for team communication. Send scheduled messages, broadcast announcements, run shift reminders, and automate group messaging via cron jobs. Use when: you want to send messages to a GroupMe group on a schedule or on-demand, automate team announcements, or create notification workflows." metadata: openclaw: requires:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # # What this script DOES: # - Takes one argument: the message text to send # - Sends it to https://api.groupme.com/v3/bots/post using your Bot ID and Access Token # - ONLY communicates with GroupMe's official API endpoint # # What this script DOES NOT DO:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # # What this script DOES: # - Takes one argument: the message text to send # - Sends it to https://api.groupme.com/v3/bots/post using your Bot ID and Access Token # - ONLY communicates with GroupMe's official API endpoint # # What this script DOES NOT DO:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # # What this script DOES: # - Takes one argument: the message text to send # - Sends it to https://api.groupme.com/v3/bots/post using your Bot ID and Access Token # - ONLY communicates with GroupMe's official API endpoint # # What this script DOES NOT DO:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # # What this script DOES: # - Takes one argument: the message text to send # - Sends it to https://api.groupme.com/v3/bots/post using your Bot ID and Access Token # - ONLY communicates with GroupMe's official API endpoint # # What this script DOES NOT DO:
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md Go to https://dev.groupme.com/bots and copy your access token (shown at the top of the page). ### 2. Create a Bot Go to https://dev.groupme.com/bots/new and create a new bot: - **Name:** Whatever you want (e.g., "OpenClaw", "Team Bot")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README instructs users to store a long-lived GroupMe access token and bot identifiers in a local file but does not warn that the token is sensitive or recommend file permission restrictions. This increases the risk of accidental disclosure through weak filesystem permissions, backups, dotfile syncing, screenshots, or committing the file into version control, which would allow unauthorized use of the GroupMe API.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill documents shell-based network actions but does not declare an explicit tool scope such as allowed shell/network capabilities. In an agent ecosystem, missing scope boundaries increases the chance that automation can invoke broader shell behavior than users expect, reducing containment and auditability.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation explicitly recommends passing the GroupMe access token in the URL query string but does not warn that query parameters are commonly exposed through shell history, logs, proxies, and process listings. This can leak a reusable credential and allow unauthorized access to GroupMe resources tied to the token.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 1. **GroupMe Access Token** — get it at https://dev.groupme.com/bots (top of page) 2. **Group ID** — the ID of your GroupMe group (fetch via API) 3. **Bot ID** — create a bot at https://dev.groupme.com/bots/new ### Save Your Tokens
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Run this command (replace with your token):
bash curl -s "https://api.groupme.com/v3/groups?token=YOUR_TOKEN&per_page=10"Look for your group in the response — the
idfield is your Group ID.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Setup Checklist - [ ] Get access token: https://dev.groupme.com/bots - [ ] Create bot: https://dev.groupme.com/bots/new - [ ] Find Group ID via API - [ ] Save tokens to `~/.openclaw/secrets/groupme.env` - [ ] Test: send a message manually
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # # What this script DOES: # - Takes one argument: the message text to send # - Sends it to https://api.groupme.com/v3/bots/post using your Bot ID and Access Token # - ONLY communicates with GroupMe's official API endpoint # # What this script DOES NOT DO:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # # What this script DOES: # - Takes one argument: the message text to send # - Sends it to https://api.groupme.com/v3/bots/post using your Bot ID and Access Token # - ONLY communicates with GroupMe's official API endpoint # # What this script DOES NOT DO:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # # What this script DOES: # - Takes one argument: the message text to send # - Sends it to https://api.groupme.com/v3/bots/post using your Bot ID and Access Token # - ONLY communicates with GroupMe's official API endpoint # # What this script DOES NOT DO:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # # What this script DOES: # - Takes one argument: the message text to send # - Sends it to https://api.groupme.com/v3/bots/post using your Bot ID and Access Token # - ONLY communicates with GroupMe's official API endpoint # # What this script DOES NOT DO:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # # What this script DOES: # - Takes one argument: the message text to send # - Sends it to https://api.groupme.com/v3/bots/post using your Bot ID and Access Token # - ONLY communicates with GroupMe's official API endpoint # # What this script DOES NOT DO:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh # # What this script DOES: # - Takes one argument: the message text to send # - Sends it to https://api.groupme.com/v3/bots/post using your Bot ID and Access Token # - ONLY communicates with GroupMe's official API endpoint # # What this script DOES NOT DO:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh # # What this script DOES: # - Takes one argument: the message text to send # - Sends it to https://api.groupme.com/v3/bots/post using your Bot ID and Access Token # - ONLY communicates with GroupMe's official API endpoint # # What this script DOES NOT DO: