beepctl

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:27 AM UTC
• Version: 0.1.4

Overview

This messaging skill is not clearly malicious, but it deserves review because it installs an unpinned global CLI and gives broad access to private messages, attachments, and an API token.

Install only if you trust the beepctl npm package and are comfortable giving an agent access to Beeper conversations across connected messaging services. Avoid running token-reveal commands, require explicit confirmation before sending or changing chats, use narrow chat/account filters for searches, and choose safe destination paths before downloading attachments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5
• Finding: Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium **Vulnerable Code Snippet**: ```yaml metadata: {"clawdbot":{"emoji":"🐝","requires":{"bins":["beepctl"]},"install":[{"id":"npm","kind":"npm","package":"beepctl","global":true,"bins":["beepctl"],"label":"Install beepctl (npm)"}]}} ``` ### Technical Analysis The installation configuration references `beepctl` without an exact version or integrity constraint and requests a global npm installation. Consequently, installation can resolve to whichever package version is current at that time rather than a release reviewed with this skill. The dependency implementation and any npm lifecycle scripts are not included in the audited project. Their installation-time and runtime behavior therefore cannot be verified from this artifact. If the npm package, publisher account, or a future release is compromised, package-controlled lifecycle scripts may execute during installation. A global installation also exposes the resulting executable broadly through the user's command environment. This finding identifies an unsafe supply-chain configuration; the reviewed artifact does not itself establish that the current npm package is malicious. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution process, or another component of the package's release chain. 2. The attacker publishes a malicious version under the expected `beepctl` package name. 3. A user or agent installs the skill dependency without an exact version constraint. 4. npm resolves and installs the attacker-controlled release globally. 5. Malicious lifecycle code, if present and permitted by npm configuration, executes during installation, or the installed `beepctl` executable runs attacker-controlled logic when invoked. 6. Subsequent legitimate-looking skill operations execute the co ...[truncated 618 chars]
• Remediation: ## Remediation Suggestions - Pin `beepctl` to a specific, reviewed version rather than resolving the latest available release. - Enforce package integrity using a lockfile and verified registry integrity hashes where the skill installation framework supports them. - Prefer a project-local installation over a global installation to reduce exposure and simplify dependency isolation. - Review the package's source, release provenance, maintainers, transitive dependencies, and lifecycle scripts before approving it. - Disable npm lifecycle scripts during installation where compatible with the package. - Execute the CLI under a least-privileged account or sandbox with access limited to the resources required for Beeper operations. - Establish an update process that requires security review before changing the pinned package version.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:25
• Finding: Authentication Token Exposed by Documented Status Command## Vulnerability Details **File Location**: `SKILL.md`, lines 25-29 **Vulnerability Type**: Plaintext credential disclosure through command output **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash ### Auth Management ```bash beepctl auth show # Check auth status and token beepctl auth set <token> # Set API token beepctl auth clear # Clear saved token ``` ### Technical Analysis The documentation states that `beepctl auth show` displays both authentication status and the token. Displaying a complete bearer credential during a routine status check creates unnecessary exposure. If an agent invokes this command, the token may be copied into tool results, agent transcripts, terminal scrollback, telemetry, debugging output, screenshots, or other logs. A status check generally needs only an authenticated/not-authenticated result or a short non-secret fingerprint. Returning the complete token violates secret-minimization principles and expands the number of systems through which the credential may pass. The audited file documents this behavior but does not contain the CLI implementation, so the token's storage mechanism, masking behavior, permissions, and exact authorization scope could not be independently verified. ### Attack Path 1. A user or agent runs `beepctl auth show` to diagnose authentication or verify setup. 2. The command emits the API token as described in the skill documentation. 3. The output is retained in terminal history, tool-call results, an agent transcript, logging infrastructure, or a shared support record. 4. An unauthorized party obtains access to one of those output channels. 5. The party extracts and reuses the token against the Beeper Desktop API while it remains valid. 6. The attacker performs operations allowed by the token, potentially including access to messaging information or account actions. ### Impact Assessment Exploitation could grant the ...[truncated 563 chars]
• Remediation: ## Remediation Suggestions - Change the default status command so it reports only whether authentication is configured and valid. - Redact the token by default, exposing at most a short non-secret fingerprint sufficient to distinguish credentials. - If token retrieval is operationally necessary, require a separate explicit command with a warning and interactive confirmation. - Instruct agents never to run token-reveal commands unless the user explicitly requests them and never to reproduce tokens in conversation. - Apply automatic secret redaction to command output, agent transcripts, telemetry, support bundles, and diagnostic logs. - Store the token in an operating-system credential manager or similarly protected secret store with restrictive access controls. - Support token expiration, revocation, rotation, and narrowly scoped authorization. - Rotate any token that may already have appeared in logs or transcripts and remove retained copies where possible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill enables broad search and retrieval across personal and work messaging platforms, which can expose highly sensitive message content, participant identities, and account metadata if invoked without clear user awareness and consent. In agent contexts, search/list operations are easy to overuse because they appear read-only, but they still disclose private data across multiple services.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

beepctl archive <chat-id>              # Archive a chat
beepctl archive <chat-id> --unarchive  # Unarchive
beepctl archive work                   # Use alias
beepctl archive <chat-id> --quiet      # No confirmation message
```

### Send Messages

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

beepctl archive <chat-id>              # Archive a chat
beepctl archive <chat-id> --unarchive  # Unarchive
beepctl archive work                   # Use alias
beepctl archive <chat-id> --quiet      # No confirmation message
```

### Send Messages

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documented download command writes attachments to local disk without warning that the files may contain sensitive or malicious content and may persist after the session. This creates confidentiality and endpoint risk because an agent could save private files to unintended locations or handle untrusted attachments without user review.

Static analysis

No suspicious patterns detected.