ClawHub
Back to skill

Security audit

Beeper CLI

Security checks for vulnerabilities and agentic risk

Overview

This Beeper skill is a documented messaging CLI helper, but it exposes broad live-chat read/write and file-transfer actions with limited safety scoping and an unpinned third-party CLI dependency.

Review this skill carefully before installing. Use it only if you are comfortable giving the Beeper CLI access to private chats and live messaging actions, pin and verify the CLI version where possible, keep `BEEPER_ACCESS_TOKEN` scoped and revocable, and require explicit user confirmation before any send, edit, archive, create, upload, download, or attachment operation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:20
Finding

Unpinned Third-Party CLI Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-27
Vulnerability Type: Unverified and mutable third-party dependency
Risk Level: Medium

Vulnerable Code

markdown
Requires [beeper-cli](https://github.com/foeken/beeper-cli).

## Install beeper-cli

Download from [releases](https://github.com/foeken/beeper-cli/releases), or build:

```bash
go install github.com/foeken/beeper-cli@latest
text

### Technical Analysis

The installation instructions direct users to download executable releases or run `go install` against a third-party GitHub repository using the mutable `@latest` version selector. The skill does not pin a reviewed version or immutable commit and provides no checksum, signature, provenance, or artifact-verification procedure.

Consequently, the executable installed when these instructions are followed can differ from the dependency that existed when the skill was audited. A compromise of the upstream repository, maintainer account, release process, or distribution artifacts could introduce malicious code without requiring any modification to this project.

The dependency is especially sensitive because the documented workflow provides it with access to `BEEPER_ACCESS_TOKEN` and uses it to access private chats, messages, and attachments.

### Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or its release pipeline.
2. The attacker publishes a malicious release that becomes the version resolved by `@latest`, or replaces an unverified downloadable artifact.
3. A user follows the documented installation instructions.
4. The malicious executable runs with the installing user's local privileges.
5. During installation or later use, it reads `BEEPER_ACCESS_TOKEN` from the environment.
6. It can then exfiltrate the token or use the authenticated Beeper API access to read private communications, download attachments, or perform supported account actions.

### Impact Assessment

Successful 
...[truncated 512 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with a specifically reviewed, immutable release version or commit hash.
  2. Publish expected SHA-256 checksums for downloadable artifacts and require verification before execution.
  3. Prefer signed releases and document signature verification, including the trusted signing identity or key fingerprint.
  4. Use dependency provenance or reproducible-build verification where available.
  5. Periodically review pinned versions and update them through a controlled security-review process.
  6. Run the CLI with least privilege and prevent unrelated secrets from being present in its environment.
  7. Scope or rotate BEEPER_ACCESS_TOKEN where supported, and revoke it immediately if dependency compromise is suspected.
  8. Document the exact trusted download URL and avoid installation flows that automatically resolve mutable releases.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
## Prereqs
- Beeper Desktop running with API enabled: Settings > Developers
- [beeper-cli](https://github.com/foeken/beeper-cli) installed
- Env var: `BEEPER_ACCESS_TOKEN` set (get from Beeper Desktop: Settings > Developers > API Access Token)

## Install beeper-cli

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest description narrows the skill to search/list/read/send behavior, but the documented commands also allow higher-risk state-changing actions such as archiving chats, creating chats, managing reminders, editing messages, and transferring files. This mismatch can mislead a caller or policy layer into granting or invoking the skill with less scrutiny than its true capabilities require.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill documents multiple mutating and data-transfer operations but provides only minimal warning, which increases the chance of accidental message sends, edits, chat changes, or attachment transmission. In a messaging context, unintended writes can immediately affect real user conversations and leak sensitive local files to external recipients.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.