GroupMe CLI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:55 PM UTC
• Version: 1.0.4

Overview

This skill does what it says, but installing and using it gives an unpinned external CLI access to a GroupMe token and message-sending authority.

Review the upstream groupme-cli repository and package scripts before installing, pin to a known commit if possible, prefer an environment variable over storing a long-lived token on disk, protect or rotate the token, and only grant it to an environment where reading and sending GroupMe messages is acceptable.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:34
• Finding: Unpinned Third-Party Installation Executes Unreviewed Supply-Chain Code## Vulnerability Details **File Location**: `SKILL.md`, lines 34–39 **Vulnerability Type**: Unpinned and unreviewed third-party source installation **Risk Level**: Medium ### Vulnerable Code ```bash git clone https://github.com/cuuush/groupme-cli cd groupme-cli npm install npm run bundle npm link ``` ### Technical Analysis The installation procedure clones the default branch of an external GitHub repository without pinning an immutable commit or verified release. It then invokes several operations capable of executing code supplied by that repository or its dependencies: - `npm install` can execute npm dependency lifecycle scripts. - `npm run bundle` executes a script defined by the downloaded repository. - `npm link` exposes the resulting executable through the user's npm global command environment. No commit hash, dependency integrity baseline, artifact checksum, or verified provenance is specified. The external repository and its dependencies are not included in the audited project, so their implementation and lifecycle scripts could not be verified during this audit. This creates a supply-chain trust boundary in which the effective installed code can change after the Skill has been reviewed. A compromised upstream repository, mutable default branch, malicious dependency update, or dependency-account compromise could therefore result in arbitrary code execution during installation. ### Attack Path 1. An attacker compromises the upstream repository, one of its npm dependencies, or a maintainer account. 2. The attacker introduces a malicious lifecycle script, build script, dependency version, or CLI implementation. 3. A user follows the Skill's installation instructions and clones the current upstream default branch. 4. `npm install` or `npm run bundle` executes the attacker-controlled code with the installing user's privileges. 5. `npm link` makes the compromised `groupme` executable available through th ...[truncated 850 chars]
• Remediation: ## Remediation Suggestions 1. Pin installation to an audited, immutable Git commit or cryptographically verified release rather than cloning the mutable default branch. 2. Record and verify the expected commit hash, release signature, or artifact checksum before executing any downloaded content. 3. Require a committed npm lockfile and use `npm ci` to install the exact reviewed dependency graph. 4. Review `package.json`, lifecycle hooks, bundle scripts, transitive dependencies, and the generated executable before installation. 5. Disable lifecycle scripts during initial dependency retrieval where practical, such as with `npm ci --ignore-scripts`, and run only individually reviewed build steps afterward. 6. Prefer an isolated, non-privileged environment or project-local installation over `npm link` and global command exposure. 7. Run dependency auditing and provenance verification as part of release validation. 8. Restrict the GroupMe token to the minimum practical exposure, avoid passing it directly on command lines, and protect `~/.config/groupme/config.json` with user-only file permissions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Exfiltration Commands

High

• Category: Prompt Injection

Content

---
name: groupme-cli
description: Send and read GroupMe messages via the groupme CLI. Use when asked to list groups, read messages, send messages to groups, or manage GroupMe direct messages from the command line.
metadata:
  {
    "openclaw":

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Credential Access

High

• Category: Privilege Escalation

Content

### Authentication

Get your GroupMe API token from [dev.groupme.com](https://dev.groupme.com/) → Access Token, then configure:

```bash
groupme config --token YOUR_ACCESS_TOKEN

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill is explicitly designed to read and send GroupMe messages, which necessarily transmits message content and metadata to an external service, but it provides no privacy or data-handling warning. In an agent setting, this omission can lead users to share sensitive content without understanding that third-party processing, storage, and logging may occur.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill instructs users to configure a GroupMe API token and notes that config is stored at ~/.config/groupme/config.json, but it does not warn that sensitive credentials may be persisted locally and could be readable by other local users, backups, or malware. This creates a real credential-handling weakness in documentation because users may unknowingly store long-lived secrets in an insecure location.