GroupMe CLI

• Risk level: Low
• Analyzed: Feb 19, 2026, 2:18 PM
• Findings: 0
• Version: 1.0.4

Overview

The skill's requirements and runtime instructions align with a GroupMe CLI wrapper: it only asks for the groupme binary and a GroupMe API token and gives expected usage/install steps.

This skill appears coherent with its stated purpose, but take these precautions before installing/using: 1) Review the GitHub repo (especially package.json and npm scripts) before running npm install or npm run bundle; source-built npm CLIs execute third-party code. 2) Prefer setting GROUPME_TOKEN in a protected environment variable or config file rather than passing it on the command line (CLI args can be visible in process lists). 3) Confirm you trust the repo owner (cuuush) and the bundled code; if unsure, inspect the bundled output or obtain the binary from a vetted source. 4) Store the token securely (the tool stores config at ~/.config/groupme/config.json); avoid leaving it in world-readable files. 5) If the token is compromised, revoke it from dev.groupme.com. 6) Note that the agent may invoke the skill automatically (default behavior); if you do not want autonomous calls, disable or restrict skill invocation in your agent settings.