GroupMe CLI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:55 PM UTC
• Version: 1.0.4

Overview

This skill does what it says, but installing and using it gives an unpinned external CLI access to a GroupMe token and message-sending authority.

Review the upstream groupme-cli repository and package scripts before installing, pin to a known commit if possible, prefer an environment variable over storing a long-lived token on disk, protect or rotate the token, and only grant it to an environment where reading and sending GroupMe messages is acceptable.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:34

Finding

Unpinned Third-Party Installation Executes Unreviewed Supply-Chain Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34–39
Vulnerability Type: Unpinned and unreviewed third-party source installation
Risk Level: Medium

Vulnerable Code

bash

git clone https://github.com/cuuush/groupme-cli
cd groupme-cli
npm install
npm run bundle
npm link

Technical Analysis

The installation procedure clones the default branch of an external GitHub repository without pinning an immutable commit or verified release. It then invokes several operations capable of executing code supplied by that repository or its dependencies:

• npm install can execute npm dependency lifecycle scripts.
• npm run bundle executes a script defined by the downloaded repository.
• npm link exposes the resulting executable through the user's npm global command environment.

No commit hash, dependency integrity baseline, artifact checksum, or verified provenance is specified. The external repository and its dependencies are not included in the audited project, so their implementation and lifecycle scripts could not be verified during this audit.

This creates a supply-chain trust boundary in which the effective installed code can change after the Skill has been reviewed. A compromised upstream repository, mutable default branch, malicious dependency update, or dependency-account compromise could therefore result in arbitrary code execution during installation.

Attack Path

1. An attacker compromises the upstream repository, one of its npm dependencies, or a maintainer account.
2. The attacker introduces a malicious lifecycle script, build script, dependency version, or CLI implementation.
3. A user follows the Skill's installation instructions and clones the current upstream default branch.
4. npm install or npm run bundle executes the attacker-controlled code with the installing user's privileges.
5. npm link makes the compromised groupme executable available through th ...[truncated 850 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation to an audited, immutable Git commit or cryptographically verified release rather than cloning the mutable default branch.
2. Record and verify the expected commit hash, release signature, or artifact checksum before executing any downloaded content.
3. Require a committed npm lockfile and use npm ci to install the exact reviewed dependency graph.
4. Review package.json, lifecycle hooks, bundle scripts, transitive dependencies, and the generated executable before installation.
5. Disable lifecycle scripts during initial dependency retrieval where practical, such as with npm ci --ignore-scripts, and run only individually reviewed build steps afterward.
6. Prefer an isolated, non-privileged environment or project-local installation over npm link and global command exposure.
7. Run dependency auditing and provenance verification as part of release validation.
8. Restrict the GroupMe token to the minimum practical exposure, avoid passing it directly on command lines, and protect ~/.config/groupme/config.json with user-only file permissions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: groupme-cli
description: Send and read GroupMe messages via the groupme CLI. Use when asked to list groups, read messages, send messages to groups, or manage GroupMe direct messages from the command line.
metadata:
  {
    "openclaw":

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Authentication

Get your GroupMe API token from dev.groupme.com → Access Token, then configure:

bash

groupme config --token YOUR_ACCESS_TOKEN

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill is explicitly designed to read and send GroupMe messages, which necessarily transmits message content and metadata to an external service, but it provides no privacy or data-handling warning. In an agent setting, this omission can lead users to share sensitive content without understanding that third-party processing, storage, and logging may occur.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill instructs users to configure a GroupMe API token and notes that config is stored at ~/.config/groupme/config.json, but it does not warn that sensitive credentials may be persisted locally and could be readable by other local users, backups, or malware. This creates a real credential-handling weakness in documentation because users may unknowingly store long-lived secrets in an insecure location.

Content

No source excerpt is available for this finding.