T09 · Insecure Skill Coding Practices
Error
- Location
scripts/collect_beeper_daily.py:247- Finding
Decrypted Private Messages Written to an Unsafe Predictable Temporary File
- Content
View full analysis
- Remediation
View remediation
Security audit
Unbridled
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed Beeper messaging integration, but it asks for durable access to private chats and ships several unsafe install, storage, persistence, and encryption-default choices that need review before use.
Install only on a trusted, dedicated machine or account. Review the installer before running it, pin and verify bbctl and Python dependencies, avoid the legacy client.py send command, do not use /tmp for private digests or plaintext key exports, and enable the sync daemon only if you accept persistent background access to new private-message keys.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/import_key_backup.py:321- Finding
Plaintext Megolm Session Keys Exported Without Enforced File Protection
- Content
View full analysis
`. 2. The chosen destination is in a shared directory, has permissive inherited permissions, or was prepared as a symbolic link by another local user. 3. The script decrypts the server-side key backup using the Beeper recovery key. 4. The script writes room IDs and plaintext Megolm `sess ...[truncated 615 chars]- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
install.sh:32- Finding
Mutable Remote bbctl Executable Downloaded Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
install.sh:53- Finding
Security-Critical Python Dependencies Installed Without Version or Hash Pinning
- Content
View full analysis
/dev/null 2>&1; then uv venv ~/.venvs/beeper --python 3.12 VIRTUAL_ENV=~/.venvs/beeper uv pip install \ 'matrix-nio[e2e]' aiohttp pycryptodome cryptography pynacl \ unpaddedbase64 canonicaljson else python3 -m venv ~/.venvs/beeper ~/.venvs/beeper/bin/pip install --upgrade pip ~/.venvs/beeper/bin/pip install \ 'matrix-nio[e2e]' aiohttp pycryptodome cryptography pynacl \ unpaddedbase64 canonicaljson fi ``` ### Technical Analysis The installer resolves current package versions and transitive dependencies at installation time. No lock file, exact version constraints, or artifact hashes are used. These dependencies process access tokens, recovery-derived secrets, private signing keys, encrypted message data, and the local Olm store. A compromised package release, dependency takeover, malicious transitive dependency, or incompatible future update would therefore execute in a high-sensitivity context. The listed package names appear legitimate and no typosquatted package was identified. The vulnerability is the absence of reproducible and authenticated dependency resolution. ### Attack Path 1. An upstream package account, release process, or transitive dependency is compromised. 2. A malicious package version is published under a dependency that the installer accepts. 3. A user runs `install.sh` after that version becomes the resolver’s selected release. 4. pip or uv downloads and installs the malicious package. 5. Malicious installation or runtime code executes with the user’s privileges. 6. The code reads Beeper credentials, cryptographic key material, message history, or other files available to the Agent account. ### Impact Assessment A compromised dependency can obtain arbitrary code execution in ...[truncated 221 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/nio_client.py:378- Finding
Message Encryption Keys Shared with Unverified Matrix Devices
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/client.py:169- Finding
Legacy Client Exposes a Non-E2EE Plaintext Message Send Path
- Content
View full analysis
dict: """Send a plain text message. Uses a txn ID based on epoch ms.""" txn_id = f"clawd-{int(time.time() * 1000)}" path = f"/_matrix/client/v3/rooms/{urllib.parse.quote(room_id)}/send/m.room.message/{txn_id}" body = {"msgtype": "m.text", "body": text} return put(path, creds["access_token"], creds["homeserver"], body) ``` The CLI makes this path directly available: ```python p_send = sub.add_parser("send", help="Send a message") p_send.add_argument("--room", required=True) p_send.add_argument("--text", required=True) ``` ### Technical Analysis The synchronous client directly sends an `m.room.message` event containing the plaintext body. It does not load the Olm store, create an `m.room.encrypted` event, or use `matrix-nio` encryption. HTTPS encrypts transport to the Beeper homeserver, but the message is plaintext at the Matrix application layer and is visible to the homeserver. This conflicts with the Skill’s general E2EE positioning and creates a risky alternative to the intended `nio_client.py send` implementation. Documentation characterizes `client.py` primarily as a non-E2EE listing and bridge-state helper, but the script retains a functional `send` command. An Agent selecting the wrong wrapper can therefore bypass application-layer E2EE. ### Attack Path 1. A user or Agent chooses `scripts/client.py send` instead of `scripts/nio_client.py send`. 2. The supplied message text is inserted directly into a plaintext `m.room.message` JSON body. 3. The script transmits that body to the Beeper homeserver over HTTPS. 4. The homeserver receives the plaintext message rather than a Megolm-encrypted event. 5. Depending on server policy, the event may be retaine ...[truncated 517 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (57)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The README documents that the skill relies on long-lived high-value credentials and stores them locally, including a Beeper recovery key and access token. In this skill's context, those credentials enable broad access to private communications across many bridged platforms, so compromise of the host or accidental exposure of these files could give an attacker durable cross-network message access and decryption capability.
- Content
md |---|---|---| | Beeper password | User's head / password manager | Master secret | | Beeper Recovery Key | `~/.secrets/beeper-recovery-key.txt` (600) | Master secret (decrypts cross-signing keys) | | `bbctl` access token | `~/.config/bbctl/config.json` (600) | Device-scoped credential | | Olm/Megolm store | `~/.local/share/clawd-matrix/` (700) | Device-scoped credential | If the recovery key ever leaks, **regenerate it from Beeper Desktop** (Settings → name → ⌄ → Reset Recovery Code) and re-run `bootstrap_crosssign.py` on each agent device.
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The code matches only one narrow portion of the description: bootstrapping cross-signing from the Beeper recovery key. It does not implement the broader advertised behavior of interacting with chats across Facebook Messenger, WhatsApp, Instagram, LinkedIn, Twitter/X, Signal, Telegram, Discord, etc., nor does it expose a wrapper for message operations or run a sync daemon. Instead, its actual purpose is specifically Matrix/Beeper cryptographic account setup: reading local secret files, deriving secret-storage keys, decrypting cross-signing seeds, signing the current device, and uploading signatures. Because the declared description presents a much broader end-user messaging capability while this code chunk performs only specialized E2EE/bootstrap tasks, the description does not accurately represent what this supplied code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description promises a much broader and more sophisticated skill than the supplied code implements. The code is narrowly a CLI wrapper around Matrix client-server endpoints using urllib, with commands for whoami, list-chats, send, and history. It depends on preexisting credentials in ~/.config/bbctl/config.json but contains no installation logic for bbctl, no encryption setup, no recovery-key or cross-signing bootstrap, and no background sync/decryption service. It also does not implement search, and the visible network handling covers Facebook/Messenger, Instagram, WhatsApp, LinkedIn, Twitter/X, and Discord aliases, but not other declared networks like Signal or Telegram. The core purpose is related to Beeper messaging access, but the actual behavior materially falls short of several key declared capabilities, so this is a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared purpose describes a broad, full-featured Beeper integration layer with setup/installation steps, E2EE bootstrap, ongoing sync/decryption, and interactive messaging operations including sending. The supplied code chunk is much narrower: it is a batch reporting script for collecting recent activity from selected bridged networks, optionally decrypting some message content, and saving a markdown summary locally. While it is related to Beeper and reading message activity, the primary purpose is materially different and several claimed capabilities are absent. Therefore this is a description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a broad cross-network messaging skill whose purpose is to send/read chats via Beeper bridges, set up E2EE, run a sync daemon, and expose a unified wrapper. The supplied code chunk instead performs a narrower but sensitive cryptographic maintenance task: restoring historical Matrix encryption keys from server-side backup into a local store. While this can support the overall E2EE/history-reading functionality of the larger skill, the code chunk itself does not implement the declared primary user-facing behavior of reading/sending/searching chats across social networks. It also includes an undeclared capability to export decrypted session data to a file. Therefore the description does not accurately represent what this specific code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a broad multi-network messaging skill built on Beeper/Matrix, including setup and a unified messaging wrapper. This code chunk instead performs a narrow, security-related task: interactive SAS key verification between this client and Beeper Desktop. While device verification is tangentially related to E2EE setup, the actual code does not implement the declared core functionality of reading/sending/searching messages across networks, nor the described installation/bootstrap/daemon behavior. The code’s primary purpose is materially different from the declared purpose, so this is a mismatch.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The skill explicitly depends on a Beeper access token stored in a local config file, which grants access to the user's bridged messaging environment. Any skill that reads or uses such a token has high-value credential access and, if compromised or over-permissioned, could impersonate the user across multiple messaging networks.
- Content
md ├── sync_daemon.py ← long-running sync (systemd) → new Megolm sessions └── verify_interactive.py ← fallback: SAS verification via Beeper Desktop ▼ bbctl + access token (~/.config/bbctl/config.json) ▼ https://matrix.beeper.com/_hungryserv/<user> (Matrix CS API) ▼
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
This section states that user login stores an access token in ~/.config/bbctl/config.json and that the nio client relies on it. Because that token enables authenticated messaging actions, compromise of the host, logs, or overbroad skill access could result in account takeover-like behavior across all bridged services.
- Content
bbctl login
text The user enters their Beeper credentials. This stores an access token at `~/.config/bbctl/config.json`. That token is all the nio client needs. Verify: ```bash
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash # Unsign the device: Beeper UI → Settings → Devices → sign out the bbctl device # Then on the host: rm -rf ~/.local/share/clawd-matrix # nio store rm -rf ~/.config/bbctl # bbctl access token rm ~/.secrets/beeper-recovery-key.txt # recovery key rm ~/.secrets/beeper-desktop-token # desktop API token, if ever created
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash # Unsign the device: Beeper UI → Settings → Devices → sign out the bbctl device # Then on the host: rm -rf ~/.local/share/clawd-matrix # nio store rm -rf ~/.config/bbctl # bbctl access token rm ~/.secrets/beeper-recovery-key.txt # recovery key rm ~/.secrets/beeper-desktop-token # desktop API token, if ever created
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash # Unsign the device: Beeper UI → Settings → Devices → sign out the bbctl device # Then on the host: rm -rf ~/.local/share/clawd-matrix # nio store rm -rf ~/.config/bbctl # bbctl access token rm ~/.secrets/beeper-recovery-key.txt # recovery key rm ~/.secrets/beeper-desktop-token # desktop API token, if ever created
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md # Unsign the device: Beeper UI → Settings → Devices → sign out the bbctl device # Then on the host: rm -rf ~/.local/share/clawd-matrix # nio store rm -rf ~/.config/bbctl # bbctl access token rm ~/.secrets/beeper-recovery-key.txt # recovery key rm ~/.secrets/beeper-desktop-token # desktop API token, if ever created # Keep ~/bin/bbctl if you might re-use bbctl.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Then on the host:
rm -rf ~/.local/share/clawd-matrix # nio store rm -rf ~/.config/bbctl # bbctl access token rm ~/.secrets/beeper-recovery-key.txt # recovery key rm ~/.secrets/beeper-desktop-token # desktop API token, if ever created
Keep ~/bin/bbctl if you might re-use bbctl.
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
rm -rf ~/.local/share/clawd-matrix # nio store rm -rf ~/.config/bbctl # bbctl access token rm ~/.secrets/beeper-recovery-key.txt # recovery key rm ~/.secrets/beeper-desktop-token # desktop API token, if ever created
Keep ~/bin/bbctl if you might re-use bbctl.
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md Beeper/Matrix client wrapper for Clawd. Uses the Beeper hungryserv Matrix homeserver via the standard client-server API. Reads the access token from bbctl's config (~/.config/bbctl/config.json). Connected networks (bridged in Beeper cloud): - facebook (Messenger)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md Beeper/Matrix client wrapper for Clawd. Uses the Beeper hungryserv Matrix homeserver via the standard client-server API. Reads the access token from bbctl's config (~/.config/bbctl/config.json). Connected networks (bridged in Beeper cloud): - facebook (Messenger)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python Beeper/Matrix client wrapper for Clawd. Uses the Beeper hungryserv Matrix homeserver via the standard client-server API. Reads the access token from bbctl's config (~/.config/bbctl/config.json). Connected networks (bridged in Beeper cloud): - facebook (Messenger)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The README prominently markets unified messaging, sending, reading history, and digest generation across multiple personal networks, but it does not place an equally prominent privacy warning near those capabilities. In an agent skill context, this omission matters because an integrator may enable the skill without appreciating that it can aggregate and transmit highly sensitive private cross-platform communications.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md bbctl whoami # sanity check: all bridges RUNNING # 2. Save your recovery key (never commit this!) mkdir -p ~/.secrets && chmod 700 ~/.secrets echo 'YOUR RECOVERY KEY HERE' > ~/.secrets/beeper-recovery-key.txt chmod 600 ~/.secrets/beeper-recovery-key.txt
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 83% confidence
- Finding
The README recommends enabling a persistent user-level sync daemon that continuously maintains message decryption state and inbound access. In an agent skill, that persistence increases exposure because the capability remains active beyond a single user-approved session and can silently retain access to newly delivered encrypted conversations.
- Content
scripts/sync_daemon.pywrapsmatrix-nio'ssync_foreverin a supervised loop with exponential backoff and consumes theseto_deviceevents as they arrive. Running it under systemd keeps the store always up-to-date.bash systemctl --user enable --now clawd-beeper-sync.service journalctl --user -u clawd-beeper-sync -f
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 97% confidence
- Finding
The skill requests or implies powerful capabilities including shell execution, network access, and file read/write, but does not declare an explicit permission or allowed-tools scope. In a skill that handles messaging, local secrets, access tokens, and recovery keys, missing scope boundaries increases the chance of overbroad agent actions and unintended access to sensitive resources.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - Linux (tested on Ubuntu 24.04). macOS should work too. - `python3` with `venv` - `uv` (or plain `pip`) to create the venv - `libolm-dev` (package for Olm/Megolm crypto) - `ffmpeg` (optional, for media attachments later)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
3. Save the Beeper Recovery Key
bash mkdir -p ~/.secrets && chmod 700 ~/.secrets cat > ~/.secrets/beeper-recovery-key.txt <<EOF EsUC HBcy scrf uiTy DTU2 rvEB Jmgj 9Cpa D6V2 z7Vk ZrU9 9RMh EOF
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The documented direct write access to personal chats across bridged networks confirms that the skill can perform persistent authenticated actions on the user's behalf. In this context, persistence is more dangerous because the same authenticated environment may remain available across sessions, enabling unintended or unauthorized messaging if controls fail.
- Content
md ## Safety rules for the agent This skill gives the agent direct write access to the user's personal chats on every bridged network. The agent MUST treat every `send` as a privileged operation:
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to log every outgoing send into workspace memory creates an unnecessary retention trail for sensitive private communications. If workspace files are accessible to other tools, users, backups, or sync systems, this can expose conversation metadata or content beyond the original messaging platform.
- Content
Static analysis
No suspicious patterns detected.