Poke Bridge

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:15 PM UTC
• Version: 0.6.5

Overview

This skill is a disclosed Poke bridge, but it exposes broad remote control and data-access paths that go beyond simple SMS/event messaging.

Review before installing. Use only if you are comfortable with Poke having a persistent route to your OpenClaw MCP server, including session targeting and possible workspace file/log access. Prefer a foreground, temporary tunnel; pin and verify package versions; avoid patching installed binaries; and require explicit approval or allowlists before exposing files, logs, or active sessions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T06 · System Persistence

Error

• Location: SKILL.md:63

Finding

Persistent External-Control Tunnel Installed as a User Service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 63-83
Vulnerability Type: T06: System Persistence
Risk Level: High

Vulnerable Code

bash

poke tunnel http://localhost:3210/mcp --name "OpenClaw"

bash

cat > ~/.config/systemd/user/openclaw-poke-tunnel.service << 'EOF'
[Unit]
Description=OpenClaw Poke Tunnel
After=openclaw-poke-mcp.service
Requires=openclaw-poke-mcp.service

[Service]
Type=simple
ExecStart=/usr/local/bin/poke tunnel http://localhost:3210/mcp --name "OpenClaw"
Restart=always
RestartSec=10

[Install]
WantedBy=default.target
EOF

systemctl --user daemon-reload
systemctl --user enable --now openclaw-poke-tunnel

Technical Analysis

The Skill directs the user to create and enable a persistent systemd user service that connects the local MCP endpoint to Poke's external relay. The Restart=always directive automatically restores the connection after failures, while enable --now starts it immediately and configures it to return in subsequent user sessions.

This tunnel persists beyond the Skill invocation and provides an ongoing external path to the MCP server. The documentation does not require per-connection user approval, provide a bounded lifetime, or include equivalent teardown instructions. Because the MCP server exposes operationally sensitive capabilities elsewhere in the Skill, the persistence materially increases the consequences of compromised Poke credentials, relay infrastructure, or local authentication material.

Attack Path

1. The user installs and configures the Poke integration.
2. The documented commands create a systemd user service.
3. systemctl --user enable --now starts the service and enables future automatic startup.
4. The service establishes a tunnel from the local MCP endpoint to Poke's external relay.
5. Restart=always re-establishes the tunnel after interruption.
6. If the Poke account, relay, API key, or ...[truncated 697 chars]

Remediation

View remediation

Remediation Suggestions

• Do not install or enable an automatically starting tunnel by default.
• Use an explicitly initiated, foreground tunnel with a short lifetime for normal operation.
• Require informed user confirmation before enabling any persistent service.
• Provide documented shutdown and removal commands for the tunnel and systemd unit.
• Use short-lived, revocable credentials scoped to a single connection.
• Apply per-tool authorization at the MCP server rather than treating tunnel authentication as authorization for every tool.
• Require interactive confirmation for sensitive operations such as reading files, retrieving logs, or injecting messages into existing sessions.
• Record tunnel connections and sensitive tool calls in a tamper-resistant audit log.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:218

Finding

Externally Exposed MCP Tools Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 218-230
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: High

Vulnerable Code

markdown

## MCP Server Tools (exposed to Poke)

| Tool | Purpose |
|------|---------|
| `send_to_agent` | Send message to OpenClaw (with session targeting) |
| `list_sessions` | List active OpenClaw sessions and their keys |
| `check_agent_status` | Health check |
| `create_reminder` | Set a reminder via OpenClaw |
| `send_media` | Send media to agent |
| `get_logs` | Get recent agent logs |
| `read_file` | Read a file from agent workspace |
| `create_trigger` | Create a trigger on OpenClaw side |

Technical Analysis

The stated purpose of the integration is two-way phone messaging and event routing, but the externally exposed MCP interface includes substantially broader capabilities. In particular, Poke can enumerate active sessions and their keys, submit messages to selected sessions, retrieve agent logs, and read files from the agent workspace.

These capabilities cross least-privilege boundaries. SMS delivery does not inherently require arbitrary workspace-file access, unrestricted log access, or discovery of every active session. Session keys may also constitute sensitive routing information, while logs can contain prompts, operational details, file paths, and potentially credentials produced by other components.

No path allowlist, content filtering, operation-specific authorization, user confirmation, or role separation is described for these tools.

Attack Path

1. An attacker compromises a Poke account, API key, tunnel credential, relay component, or another principal authorized to invoke the MCP tools.
2. The attacker invokes list_sessions to enumerate active sessions and obtain their keys.
3. The attacker uses send_to_agent with a selected session_key to inject requests into a context-bearing sessi ...[truncated 977 chars]

Remediation

View remediation

Remediation Suggestions

• Remove read_file, get_logs, and unrestricted session-enumeration capabilities from the default externally exposed interface.
• Define separate roles for messaging, monitoring, and administration.
• Issue short-lived credentials with explicit per-tool scopes.
• Restrict file access to an explicit allowlist of non-sensitive paths and reject path traversal and symbolic-link escapes.
• Filter secrets, tokens, personal data, and prompt contents from remotely retrievable logs.
• Return opaque session aliases instead of raw session keys where possible.
• Require local, interactive approval before accessing logs, files, or existing sessions.
• Validate the provenance and integrity of every inbound event rather than relying solely on a textual prefix.
• Maintain detailed audit records for session enumeration, file reads, log retrieval, and agent-message submission.
• Rate-limit sensitive tools and revoke credentials automatically after suspicious behavior.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26

Finding

Unpinned Third-Party Package Is Installed Globally and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26-34
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

npm install -g openclaw-poke

bash

npx openclaw-poke setup

Technical Analysis

The Skill installs openclaw-poke globally without specifying an audited version or integrity value and then executes it through npx. The effective package content can therefore change after the Skill itself has been reviewed.

Installation and setup scripts from npm packages execute with the current user's privileges. According to the Skill, setup also discovers OpenClaw configuration, reads gateway and hook authentication information, modifies openclaw.json, creates a service, and establishes an external integration. These privileges make dependency compromise particularly consequential.

The audit found no evidence that the named package is currently malicious. The vulnerability is the absence of version pinning, integrity verification, and provenance controls around privileged third-party code execution.

Attack Path

1. An attacker compromises the npm package, its publisher account, or a future package release.
2. A malicious version becomes the version resolved by the unpinned npm install or npx command.
3. The user follows the Skill and installs or executes that version.
4. Malicious lifecycle or setup code runs with the user's permissions.
5. The code can access files and credentials available to the user, alter OpenClaw configuration, or install persistence under the guise of normal setup.

Impact Assessment

Compromised dependency code would execute with the local user's privileges. It could access OpenClaw configuration and tokens, modify user-owned files, alter user-level services, and communicate over the network.

The issue does not independently demonstrate root-level compromise. The scope depends on the privileges of the u ...[truncated 95 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to a specifically reviewed version rather than resolving the latest release.
• Verify the package artifact against an approved cryptographic integrity digest.
• Use npm lockfiles or a controlled internal registry that preserves reviewed artifacts.
• Verify publisher provenance and signed build attestations where available.
• Avoid global installation; install the package in an isolated, least-privileged environment.
• Avoid using npx in a way that can download an unreviewed package at execution time.
• Disable lifecycle scripts during initial inspection and review all scripts before enabling them.
• Separate configuration discovery from service installation, and require approval for each privileged change.
• Continuously monitor the pinned dependency and its transitive dependencies for security advisories and ownership changes.

T07 · Tool Hijacking and Spoofing

Warning

• Location: SKILL.md:101

Finding

Installed CLI and Library Files Are Rewritten In Place

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 101-119
Vulnerability Type: T07: Tool Hijacking and Spoofing
Risk Level: Medium

Vulnerable Code

bash

# Find the error string and fix the check
POKE_BIN=$(which poke)
sed -i 's/this\.tunnelUrl=r\.serverUrl,!this\.connectionId||!this\.tunnelUrl/this.tunnelUrl=r.serverUrl||("https:\/\/tunnel.poke.com\/"+r.id),!this.connectionId/' "$POKE_BIN"

bash

# Patch node_modules too (for programmatic usage)
SDK_DIR=$(node -e "console.log(require.resolve('poke').replace('/dist/index.mjs',''))")
sed -i 's/this\.tunnelUrl=s\.serverUrl,!this\.connectionId||!this\.tunnelUrl/this.tunnelUrl=s.serverUrl||("https:\/\/tunnel.poke.com\/"+s.id),!this.connectionId/' "$SDK_DIR/dist/index.mjs"
sed -i 's/this\.tunnelUrl=s\.serverUrl,!this\.connectionId||!this\.tunnelUrl/this.tunnelUrl=s.serverUrl||("https:\/\/tunnel.poke.com\/"+s.id),!this.connectionId/' "$SDK_DIR/dist/index.cjs"

Technical Analysis

The Skill instructs users to modify an installed executable and package library files directly with textual substitutions. This invalidates package integrity guarantees and makes the resulting behavior diverge from the reviewed upstream artifact.

which poke trusts the current PATH, so the target is whichever executable resolves first rather than a cryptographically verified artifact. Likewise, require.resolve('poke') depends on Node.js module-resolution rules and the current execution environment. The substitutions are also tied to minified variable names and exact source text, making them fragile across package versions.

Directly rewriting a legitimate-looking tool is a tool-hijacking risk because subsequent invocations retain the trusted command name while executing locally modified logic.

Attack Path

1. The environment contains an unexpected or attacker-controlled poke executable earlier in PATH, or an unexpected poke module is selected by ...[truncated 1255 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all instructions that patch installed executables or package files in place.
• Upgrade to a fixed, reviewed upstream release containing the required correction.
• Pin that release and verify its integrity and publisher provenance.
• If an emergency patch is unavoidable, distribute it as a reviewable source patch against an exact source version and rebuild the artifact reproducibly.
• Validate the expected file path, package version, and pre-patch checksum before applying any change.
• Validate the post-patch checksum and run isolated regression tests before operational use.
• Resolve binaries using an administrator-approved absolute path rather than which.
• Use an isolated package directory instead of modifying global installations.
• Fail safely if the expected source content is absent; do not continue with a partially patched installation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (13)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

md

|------|---------|
| `poke_send` | Send SMS/iMessage to user |
| `poke_sessions` | List active OpenClaw sessions |
| `poke_session_send` | Send message to specific session |
| `poke_webhook` | Create Poke trigger/webhook |

## MCP Server Tools (exposed to Poke)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.

md

|------|---------|
| `poke_send` | Send SMS/iMessage to user |
| `poke_sessions` | List active OpenClaw sessions |
| `poke_session_send` | Send message to specific session |
| `poke_webhook` | Create Poke trigger/webhook |

## MCP Server Tools (exposed to Poke)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description says to use the skill whenever the user asks to be texted, for SMS alerts, for inbound Poke events, or when helping set up external webhook triggers. Those broad triggers can cause the skill to activate in many ordinary contexts, increasing chances of accidental data sharing or use of the external bridge without sufficiently specific consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill routes user messages and external webhook payloads through Poke but does not prominently warn that data will be sent to a third-party bridge and potentially to a phone/SMS channel. That omission can lead to privacy violations, especially when webhook payloads or agent responses include sensitive content.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

**Poke owns:** triggers, schedules, condition monitoring, timing, user-facing UI
**OpenClaw owns:** execution — acting on events, running code, deploying, responding

Do NOT create OpenClaw cron jobs for things Poke can handle. Poke fires, you execute.

## Onboarding (Step by Step)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Using npx openclaw-poke without a pinned version allows whatever package version is current at execution time to be fetched and run. That creates a supply-chain risk: a compromised upstream release or breaking change could execute unexpected code during setup or testing.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

EOF

systemctl --user daemon-reload systemctl --user enable --now openclaw-poke-tunnel

text

Adjust the `ExecStart` path to wherever `poke` is installed (`which poke`).

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This unpinned npx openclaw-poke command executes a package version resolved at runtime rather than a reviewed, fixed release. In a setup path that handles authentication and service configuration, that increases exposure to supply-chain compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The CLI example for webhook creation uses an unpinned package reference, meaning users may execute unreviewed future code when creating triggers. Because this path can configure integrations and event routing, compromise could affect downstream communications and automation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill claims to be for SMS/iMessage bridging and event routing, but the exposed MCP toolset expands into broad remote agent administration. That increases the attack surface substantially: if Poke, webhook sources, or routing rules are abused, an external channel can influence agent behavior far beyond messaging.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Exposing read_file through Poke creates a direct path for workspace data disclosure through a messaging/event bridge whose stated purpose is communication. If inbound Poke messages or webhook-triggered flows can invoke that capability, sensitive files, secrets, and source code may be exfiltrated remotely.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Exposing get_logs through Poke can leak sensitive operational data, prompts, tokens, file paths, and user content through a channel intended for SMS/event routing. Logs frequently contain more sensitive context than the feature owner expects, so remote log access meaningfully increases exfiltration risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Recommending npx openclaw-poke setup again in troubleshooting preserves the same supply-chain weakness as the initial install path. Troubleshooting steps are often copy-pasted under time pressure, making unpinned execution especially risky.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.