ClawHub
Back to skill

Security audit

beepctl

Security checks for vulnerabilities and agentic risk

Overview

This messaging skill is not clearly malicious, but it deserves review because it installs an unpinned global CLI and gives broad access to private messages, attachments, and an API token.

Install only if you trust the beepctl npm package and are comfortable giving an agent access to Beeper conversations across connected messaging services. Avoid running token-reveal commands, require explicit confirmation before sending or changing chats, use narrow chat/account filters for searches, and choose safe destination paths before downloading attachments.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code Snippet:

yaml
metadata: {"clawdbot":{"emoji":"🐝","requires":{"bins":["beepctl"]},"install":[{"id":"npm","kind":"npm","package":"beepctl","global":true,"bins":["beepctl"],"label":"Install beepctl (npm)"}]}}

Technical Analysis

The installation configuration references beepctl without an exact version or integrity constraint and requests a global npm installation. Consequently, installation can resolve to whichever package version is current at that time rather than a release reviewed with this skill.

The dependency implementation and any npm lifecycle scripts are not included in the audited project. Their installation-time and runtime behavior therefore cannot be verified from this artifact. If the npm package, publisher account, or a future release is compromised, package-controlled lifecycle scripts may execute during installation. A global installation also exposes the resulting executable broadly through the user's command environment.

This finding identifies an unsafe supply-chain configuration; the reviewed artifact does not itself establish that the current npm package is malicious.

Attack Path

  1. An attacker compromises the npm publisher account, package distribution process, or another component of the package's release chain.
  2. The attacker publishes a malicious version under the expected beepctl package name.
  3. A user or agent installs the skill dependency without an exact version constraint.
  4. npm resolves and installs the attacker-controlled release globally.
  5. Malicious lifecycle code, if present and permitted by npm configuration, executes during installation, or the installed beepctl executable runs attacker-controlled logic when invoked.
  6. Subsequent legitimate-looking skill operations execute the co ...[truncated 618 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin beepctl to a specific, reviewed version rather than resolving the latest available release.
  • Enforce package integrity using a lockfile and verified registry integrity hashes where the skill installation framework supports them.
  • Prefer a project-local installation over a global installation to reduce exposure and simplify dependency isolation.
  • Review the package's source, release provenance, maintainers, transitive dependencies, and lifecycle scripts before approving it.
  • Disable npm lifecycle scripts during installation where compatible with the package.
  • Execute the CLI under a least-privileged account or sandbox with access limited to the resources required for Beeper operations.
  • Establish an update process that requires security review before changing the pinned package version.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:25
Finding

Authentication Token Exposed by Documented Status Command

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-29
Vulnerability Type: Plaintext credential disclosure through command output
Risk Level: Medium

Vulnerable Code Snippet:

bash
### Auth Management
```bash
beepctl auth show           # Check auth status and token
beepctl auth set <token>    # Set API token
beepctl auth clear          # Clear saved token

Technical Analysis

The documentation states that beepctl auth show displays both authentication status and the token. Displaying a complete bearer credential during a routine status check creates unnecessary exposure. If an agent invokes this command, the token may be copied into tool results, agent transcripts, terminal scrollback, telemetry, debugging output, screenshots, or other logs.

A status check generally needs only an authenticated/not-authenticated result or a short non-secret fingerprint. Returning the complete token violates secret-minimization principles and expands the number of systems through which the credential may pass.

The audited file documents this behavior but does not contain the CLI implementation, so the token's storage mechanism, masking behavior, permissions, and exact authorization scope could not be independently verified.

Attack Path

  1. A user or agent runs beepctl auth show to diagnose authentication or verify setup.
  2. The command emits the API token as described in the skill documentation.
  3. The output is retained in terminal history, tool-call results, an agent transcript, logging infrastructure, or a shared support record.
  4. An unauthorized party obtains access to one of those output channels.
  5. The party extracts and reuses the token against the Beeper Desktop API while it remains valid.
  6. The attacker performs operations allowed by the token, potentially including access to messaging information or account actions.

Impact Assessment

Exploitation could grant the ...[truncated 563 chars]

Remediation
View remediation

Remediation Suggestions

  • Change the default status command so it reports only whether authentication is configured and valid.
  • Redact the token by default, exposing at most a short non-secret fingerprint sufficient to distinguish credentials.
  • If token retrieval is operationally necessary, require a separate explicit command with a warning and interactive confirmation.
  • Instruct agents never to run token-reveal commands unless the user explicitly requests them and never to reproduce tokens in conversation.
  • Apply automatic secret redaction to command output, agent transcripts, telemetry, support bundles, and diagnostic logs.
  • Store the token in an operating-system credential manager or similarly protected secret store with restrictive access controls.
  • Support token expiration, revocation, rotation, and narrowly scoped authorization.
  • Rotate any token that may already have appeared in logs or transcripts and remove retained copies where possible.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill enables broad search and retrieval across personal and work messaging platforms, which can expose highly sensitive message content, participant identities, and account metadata if invoked without clear user awareness and consent. In agent contexts, search/list operations are easy to overuse because they appear read-only, but they still disclose private data across multiple services.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

beepctl archive # Archive a chat beepctl archive --unarchive # Unarchive beepctl archive work # Use alias beepctl archive --quiet # No confirmation message

text

### Send Messages

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

beepctl archive # Archive a chat beepctl archive --unarchive # Unarchive beepctl archive work # Use alias beepctl archive --quiet # No confirmation message

text

### Send Messages

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented download command writes attachments to local disk without warning that the files may contain sensitive or malicious content and may persist after the session. This creates confidentiality and endpoint risk because an agent could save private files to unintended locations or handle untrusted attachments without user review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.