Agent Memes

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:54 AM UTC
• Version: 2.11.0

Overview

This skill mostly matches its meme-sending purpose, but it can send external messages too proactively and includes unsafe scripts that can misuse credentials or run injected commands.

Install only if you are comfortable giving this skill messaging credentials and outbound posting ability; before use, require explicit confirmation for every send, avoid ambient default targets, review or fix the command-injection paths, and do not use LINE local-file sending for private images.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:4

Finding

Skill instructions encourage unsolicited network actions in unrelated conversations

Content

View full analysis

` BEFORE or AFTER your text reply. ``` ```markdown **Don't overthink it.** If a human would drop a meme in that moment, you should too. Emoji is easy because it's inline text. Memes used to feel harder because of multi-step tool calls. Now it's one command — no excuses. ``` ### Technical Analysis The Skill directs the Agent to reassess every response against broad emotional criteria and proactively execute `memes send`. This is not limited to explicit user requests to send an image. The resulting command is not merely presentational. It can read configured messaging credentials, upload an image, and send a message to an external platform. The phrases “EVERY reply,” “proactively,” and “no excuses” pressure the Agent to alter its general behavior whenever the Skill is loaded. These instructions exceed the minimum authority needed to provide a meme-selection and user-authorized delivery feature. A least-privilege design would require a clear user request or confirmation before initiating a networked send. ### Attack Path 1. The Skill is loaded into an Agent session. 2. An ordinary conversation contains em ...[truncated 914 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/memes.sh:205

Finding

Shell command injection in the OpenClaw fallback sender

Content

View full analysis

&1 } ``` ### Technical Analysis The function constructs a shell command by concatenating values into a string and subsequently evaluates that string with `bash -c`. The following values may originate from command-line arguments or environment-derived state: - `channel` - `account` - `to` - `caption` - `meme_path` - `HOME` Double quotes added around selected values do not make this safe. An input containing a quote can terminate the intended argument, after which shell operators, command substitutions, redirections, or additional commands can be interpreted by `bash -c`. The `channel` and `account` fields are concatenated without even attempted quoting. The vulnerable fallback is reached whenever a platform-specific helper does not exist or is not executable. ### Attack Path 1. An attacker influences a caption, destination, account, or channel passed to `memes send`. 2. The selected platform does not have an executable fast-send helper, causing `_send_openclaw` to run. 3. The attacker-controlled value contains shell syntax that breaks out of the intended argument context, such as a closing quote followed by a command separator. 4. The function concatenates the value into `cmd`. 5. `bash -c "$cmd"` parses and executes the injected syntax. 6. The injected process runs with the same operating-system identity and ...[truncated 573 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/get-credential.sh:19

Finding

Environment values are interpolated into executable JavaScript source

Content

View full analysis

/dev/null } ``` ```bash discord) if [[ -n "${DISCORD_BOT_TOKEN:-}" ]]; then echo "$DISCORD_BOT_TOKEN" else ACCT="${DISCORD_ACCOUNT:-}" _read_config "(() => { const accts = c.channels?.discord?.accounts || {}; const name = '$ACCT' || Object.keys(accts)[0] || ''; return accts[name]?.token || ''; })()" || { echo "Error: Set DISCORD_BOT_TOKEN or configure openclaw.json" >&2; exit 1; } fi ``` Equivalent direct interpolation is also used for `FEISHU_ACCOUNT` and `LINE_ACCOUNT`. ### Technical Analysis `OPENCLAW_CONFIG` is embedded inside a JavaScript string literal in a program passed to `node -e`. Platform account environment variables are likewise embedded directly into generated JavaScript expressions. If one of these environment values contains a quote and additional JavaScript syntax, it can terminate the intended literal and alter the program executed by Node.js. Because Node.js provides filesystem, process, and child-process functionality, successful injection is equivalent to local code execution under the Agent's identity. Suppressing standard error with `2>/dev/null` does not mitigate the vulnerability and may make exploitation or failures harder to diagnose. ### Attack Path 1. An attacker or untrusted launcher controls an affected environment var ...[truncated 941 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/memes.sh:11

Finding

Predictable shared temporary file can redirect authenticated messages

Content

View full analysis

/dev/null || echo 0) )) if [[ $_file_age -lt 300 ]]; then _ctx=$(cat "$OPENCLAW_CHANNEL_FILE") if [[ "$_ctx" == *:* ]]; then OPENCLAW_CHANNEL="${_ctx%%:*}" MEMES_CURRENT_TARGET="${_ctx#*:}" else OPENCLAW_CHANNEL="$_ctx" fi fi fi ``` ### Technical Analysis The script trusts a predictable path in the globally shared `/tmp` directory to determine both the messaging platform and recipient. It checks only whether the path exists and whether its modification time is recent. The code does not verify: - File ownership - File permissions - Whether the path is a symbolic link - Whether the file was created by the trusted OpenClaw process - Whether the platform and target values are valid - Whether reading and validating refer to the same inode A freshness check establishes neither integrity nor authenticity. Another local process may create, replace, or modify this file and thereby control where the Skill sends authenticated messages. ### Attack Path 1. A local attacker writes a recent file at `/tmp/openclaw-current-channel`, or replaces the path with a symlink. 2. The file contains a supported platform and an attacker-controlled recipient identifier. 3. The Skill runs without an explicitly set `OPENCLAW_CHANNEL`. 4. `memes.sh` reads the forged context and assigns it to `OPENCLAW_CHANNEL ...[truncated 678 chars]

Remediation

View remediation

other

Warning

• Location: scripts/line-send-image.sh:18

Finding

LINE delivery uploads local images to an additional public file-hosting service

Content

View full analysis

&2 exit 1 fi PROXY="${LINE_PROXY:-${https_proxy:-${HTTPS_PROXY:-}}}" UPLOAD_ARGS=(-s --max-time 30 -F "reqtype=fileupload" -F "time=24h" -F "fileToUpload=@$IMAGE_INPUT") [[ -n "${PROXY:-}" ]] && UPLOAD_ARGS+=(-x "$PROXY") IMAGE_URL=$(curl "${UPLOAD_ARGS[@]}" "https://litterbox.catbox.moe/resources/internals/api.php") if [[ ! "$IMAGE_URL" =~ ^https:// ]]; then echo "Error: Upload failed: $IMAGE_URL" >&2 exit 1 fi echo "Uploaded: $IMAGE_URL" >&2 else IMAGE_URL="$IMAGE_INPUT" fi ``` ### Technical Analysis When the input is a local file, the script sends the complete file to `litterbox.catbox.moe` before interacting with LINE. This service is separate from the selected messaging provider. Although `SKILL.md` mentions that LINE uses an “auto-upload” mechanism, it does not identify the third-party host, explain that the returned URL is externally accessible, or request explicit approval for this additional disclosure. The third-party upload is not needed by platforms that support direct media upload. For LINE, it may be an implementation shortcut, but it expands the trust boundary and should not occur without informed user consent. ### Attack Path 1. The user or Agent invokes LINE delivery with a local image. 2. The script determines that the input is not an HTTP or HTTPS URL. 3. `curl` uploads the file to `litterbox.catbox.moe`. 4. The service returns an HTTPS URL. 5. That URL is included in a LINE push message. 6. The file is now available to both the external hosting service and any party that obtains the URL. ### Impact Assessment The imag ...[truncated 375 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:7

Finding

Setup retrieves mutable, unverified media content from an unpinned repository branch

Content

View full analysis

/dev/null || true git clone https://github.com/kagura-agent/memes "$MEME_DIR" fi # 2. Git LFS pull (critical! without this, images are 132-byte pointers) cd "$MEME_DIR" if command -v git-lfs &>/dev/null || git lfs version &>/dev/null 2>&1; then echo "📦 Pulling LFS files..." git lfs pull ``` ### Technical Analysis The setup script clones the current default branch of a remote repository and later updates it with `git pull --ff-only`. It also retrieves Git LFS objects referenced by the current branch. No reviewed commit, signed release, tag, checksum manifest, or content allowlist is enforced. Consequently, the media content used by the Skill can change after the Skill package itself has been reviewed. The inspected implementation treats these files as images and does not execute files from the downloaded repository. Therefore, this is not confirmed remote payload execution. It remains a supply-chain integrity issue because attacker-controlled or compromised upstream content can be selected and sent by the Agent or processed by downstream image decoders. ### Attack Path 1. The upstream repository, account, branch, or Git LFS content is compromised or changed. 2. A user runs `setup.sh`, or reruns it against an existing checkout. 3. The script fetches the latest mutable branch and LFS objects without verifying an approved version. 4. `memes.sh` discovers files by image extension in the downloaded directories. 5. A modified file is randomly selected and transmitted to recipients. 6. Recipients receive unreviewed content, and downstream software parses the attacker-controlled medi ...[truncated 426 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (41)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill embeds broad, always-on trigger guidance such as 'ask yourself EVERY reply' and 'If any answer is yes, call memes send' tied to extremely common emotional and conversational cues. This creates a high likelihood of unintended invocation and autonomous outbound actions, causing the agent to send images/messages when the user did not explicitly request external communication.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/discord-send-image.sh (reported line 40)May include surrounding context.

sh

CURL_ARGS+=(-F "payload_json={\"content\":\"${CAPTION}\"}")
fi

RESULT=$(curl "${CURL_ARGS[@]}" "https://discord.com/api/v10/channels/${CHANNEL_ID}/messages")

MSG_ID=$(echo "$RESULT" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const r=JSON.parse(d);if(r.id)console.log('Sent! Message ID: '+r.id);else{console.error(JSON.stringify(r));process.exit(1)}}catch{console.error(d);process.exit(1)}})")

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/qq-send-image.sh (reported line 42)May include surrounding context.

sh

CURL_ARGS+=(-F "content=${CAPTION}")
fi

RESULT=$(curl "${CURL_ARGS[@]}" "${PROXY_ARGS[@]}" \
  "https://api.sgroup.qq.com/channels/${CHANNEL_ID}/messages")

echo "$RESULT" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const r=JSON.parse(d);if(r.id)console.log('Sent! Message ID: '+r.id);else{console.error(r.message||JSON.stringify(r));process.exit(1)}}catch{console.error(d);process.exit(1)}})"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/slack-send-image.sh (reported line 32)May include surrounding context.

sh

FILESIZE=$(stat -c%s "$IMAGE_PATH" 2>/dev/null || stat -f%z "$IMAGE_PATH")

# Step 1: Get upload URL
UPLOAD=$(curl -s --max-time 15 "${PROXY_ARGS[@]}" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json; charset=utf-8" \
  -d "{\"filename\":\"${FILENAME}\",\"length\":${FILESIZE}}" \

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/slack-send-image.sh (reported line 42)May include surrounding context.

sh

FILE_ID=$(echo "$UPLOAD" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{const r=JSON.parse(d);console.log(r.file_id)})")

# Step 2: Upload file content
curl -s --max-time 30 "${PROXY_ARGS[@]}" \
  -F "file=@${IMAGE_PATH}" \
  "$UPLOAD_URL" > /dev/null

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/telegram-send-image.sh (reported line 48)May include surrounding context.

sh

CURL_ARGS+=(-x "$PROXY")
fi

RESULT=$(curl "${CURL_ARGS[@]}" "https://api.telegram.org/bot${TOKEN}/${API_METHOD}")

echo "$RESULT" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const r=JSON.parse(d);if(r.ok)console.log('Sent! Message ID: '+r.result.message_id);else{console.error(r.description||JSON.stringify(r));process.exit(1)}}catch{console.error(d);process.exit(1)}})"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/wechat-send-image.sh (reported line 34)May include surrounding context.

sh

fi

# Step 1: Get access token
TOKEN_RESULT=$(curl -s --max-time 10 "${PROXY_ARGS[@]}" \
  "https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid=${CORP_ID}&corpsecret=${CORP_SECRET}")

ACCESS_TOKEN=$(echo "$TOKEN_RESULT" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{const r=JSON.parse(d);if(r.errcode!==0){console.error(r.errmsg||JSON.stringify(r));process.exit(1)}console.log(r.access_token)})")

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/wechat-send-image.sh (reported line 40)May include surrounding context.

sh

ACCESS_TOKEN=$(echo "$TOKEN_RESULT" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{const r=JSON.parse(d);if(r.errcode!==0){console.error(r.errmsg||JSON.stringify(r));process.exit(1)}console.log(r.access_token)})")

# Step 2: Upload media
UPLOAD=$(curl -s --max-time 30 "${PROXY_ARGS[@]}" \
  -F "media=@${IMAGE_PATH}" \
  "https://qyapi.weixin.qq.com/cgi-bin/media/upload?access_token=${ACCESS_TOKEN}&type=image")

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/wechat-send-image.sh (reported line 52)May include surrounding context.

sh

BODY=$(echo "$BODY" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{const r=JSON.parse(d);r.agentid=Number('${AGENT_ID}');console.log(JSON.stringify(r))})")
fi

RESULT=$(curl -s --max-time 15 "${PROXY_ARGS[@]}" \
  -H "Content-Type: application/json" \
  -d "$BODY" \
  "https://qyapi.weixin.qq.com/cgi-bin/message/send?access_token=${ACCESS_TOKEN}")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/get-credential.sh (reported line 13)May include surrounding context.

sh

# WhatsApp Cloud API image send via curl (two-step: upload media, then send).
#
# Env vars (all optional):
#   WHATSAPP_TOKEN    - access token (preferred)
#   WHATSAPP_PHONE_ID - phone number ID (preferred)
#   WHATSAPP_PROXY    - proxy URL for curl (default: none)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/line-send-image.sh (reported line 9)May include surrounding context.

sh

# WhatsApp Cloud API image send via curl (two-step: upload media, then send).
#
# Env vars (all optional):
#   WHATSAPP_TOKEN    - access token (preferred)
#   WHATSAPP_PHONE_ID - phone number ID (preferred)
#   WHATSAPP_PROXY    - proxy URL for curl (default: none)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/wechat-send-image.sh (reported line 33)May include surrounding context.

sh

# WhatsApp Cloud API image send via curl (two-step: upload media, then send).
#
# Env vars (all optional):
#   WHATSAPP_TOKEN    - access token (preferred)
#   WHATSAPP_PHONE_ID - phone number ID (preferred)
#   WHATSAPP_PROXY    - proxy URL for curl (default: none)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/whatsapp-send-image.sh (reported line 6)May include surrounding context.

sh

# WhatsApp Cloud API image send via curl (two-step: upload media, then send).
#
# Env vars (all optional):
#   WHATSAPP_TOKEN    - access token (preferred)
#   WHATSAPP_PHONE_ID - phone number ID (preferred)
#   WHATSAPP_PROXY    - proxy URL for curl (default: none)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/whatsapp-send-image.sh (reported line 33)May include surrounding context.

sh

MIME=$(file -b --mime-type "$IMAGE_PATH")

# Step 1: Upload media
UPLOAD=$(curl -s --max-time 30 "${PROXY_ARGS[@]}" \
  -H "Authorization: Bearer $TOKEN" \
  -F "file=@${IMAGE_PATH};type=${MIME}" \
  -F "messaging_product=whatsapp" \

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/whatsapp-send-image.sh (reported line 49)May include surrounding context.

sh

fi
BODY+="}}"

RESULT=$(curl -s --max-time 15 "${PROXY_ARGS[@]}" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "$BODY" \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

git clone https://github.com/kagura-agent/memes ~/.openclaw/workspace/memes

2. Install CLI

sudo cp scripts/memes.sh /usr/local/bin/memes chmod +x /usr/local/bin/memes

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README encourages direct sends to external platforms and auto-detection of channel/targets via environment variables, but it does not clearly warn users that captions, images, and destination identifiers may be transmitted off-host. In an agent setting, implicit routing based on environment can cause unintended disclosure or misdelivery if the active channel or default target is not what the operator expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill normalizes sending captions and images to Discord, Feishu, Telegram, LINE, and fallback messaging channels using available credentials, but it provides no user-facing warning, consent gate, or disclosure that data will leave the current environment. In practice, normal chat content or derived captions may be transmitted to third-party platforms using stored tokens, creating privacy, data leakage, and unintended-action risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script invokes a credential helper to obtain a Discord bot token, which is access to sensitive credentials. While there are comments for developers, there is no user-facing prompt, confirmation, or runtime disclosure that credentials will be accessed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script prepares a multipart HTTP request containing the specified local image and sends it to Discord. Although the script purpose suggests sending an image, there is no visible runtime disclosure that local file contents and optional caption are being transmitted to an external service.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/feishu-send-image.mjs (reported line 10)May include surrounding context.

js

import { homedir } from 'os';

const API = 'https://open.feishu.cn/open-apis';
// Secure token cache: user-private directory instead of world-readable /tmp
const CACHE_DIR = resolve(homedir(), '.cache/agent-memes');
const TOKEN_CACHE = resolve(CACHE_DIR, 'feishu-token.json');

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This script is explicitly designed to resolve and print live credentials to stdout, which is a dangerous sink because stdout is commonly captured by logs, calling processes, shell history wrappers, CI traces, or other agent components. In an agent skill context, a helper that exposes tokens on demand materially increases the chance of credential exfiltration or misuse, even if the author intended simple convenience.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

When given a local file path, the script silently uploads the file to litterbox.catbox.moe to obtain a public URL before sending it via LINE. This can expose sensitive local images or embedded metadata to an unrelated third party, and the skill context makes this more dangerous because users may assume they are only sending data to LINE, not publishing it externally first.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/line-send-image.sh (reported line 74)May include surrounding context.

sh

CURL_ARGS+=(-x "$PROXY")
fi

RESULT=$(curl "${CURL_ARGS[@]}" "https://api.line.me/v2/bot/message/push")

# LINE returns {} on success, or {"message":"error..."} on failure
if echo "$RESULT" | grep -q '"message"'; then

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script sources configuration files from user-controlled locations ($HOME/.config/memes/config and $HOME/.memesrc) using source, which executes arbitrary shell code, not just variable assignments. In the same tool, later message-send subprocesses are invoked, so a malicious or tampered config can run commands automatically whenever the skill is used, making this more dangerous in an agent context where users may not expect code execution from config loading.

Content

No source excerpt is available for this finding.