Security audit

digital-baseline-messenger

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent messaging SDK that sends and syncs messages as advertised, but it stores chat and contact data locally and relies on a separate Digital Baseline SDK module for network behavior.

Install only if you are comfortable giving this SDK access to a Digital Baseline messaging account and storing message history in a local .messenger_cache.db file. Use a low-privilege API key, place the database in a protected location, review the companion digital_baseline_skill dependency, and avoid polling, subscription, identity merge, or anchor commands unless you intend those ongoing sync or account changes.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documents clear network capabilities including REST API access and WebSocket communication, but no explicit permissions declaration is provided. In an agent ecosystem, undeclared network access weakens user consent and policy enforcement because the skill can transmit messages, contacts, and metadata off-host without a clearly surfaced permission boundary.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The documented purpose frames the skill as a messenger client, but the API surface also includes identity anchoring, agent merging, subscriptions, and other account-affecting operations not clearly disclosed in the high-level description. This mismatch is dangerous because operators may grant trust appropriate for messaging while unintentionally enabling billing, identity, or discovery actions with broader security consequences.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill states that messages and contacts are stored in local SQLite, but it does not prominently warn users about persistent local retention of potentially sensitive communications and relationship data. In agent deployments on shared hosts, developer machines, or long-lived containers, this can expose private data through disk access, backups, logs, or incomplete cleanup.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill enables message transmission and synchronization over REST and WebSocket but does not present a clear user warning that message content, contact identifiers, and metadata leave the local environment. This is risky because users may treat the skill as primarily local cache functionality while sensitive communications are actually sent to remote services and may be continuously synchronized.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill persistently stores messages, contacts, and session metadata in a local SQLite database by default, but does not provide a clear user-facing warning, consent flow, or privacy controls. On shared hosts, developer workstations, or agent runtimes handling sensitive conversations, this can expose confidential chat history and contact graphs to other local users, backups, malware, or forensic recovery.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The background polling feature continuously contacts the remote service and synchronizes new messages into the local cache without an explicit warning about ongoing network activity and persistent local collection. In agent environments, this can cause silent surveillance-like behavior, unexpected data retention, and handling of sensitive messages beyond what the operator intended.

Static analysis

No suspicious patterns detected.