Google Messages

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:57 AM UTC
• Version: 0.1.0

Overview

This skill mostly matches its Google Messages purpose, but it needs Review because its notification webhook forwards private text previews and can execute shell commands built from message content.

Review carefully before installing. Do not enable the webhook or persistent service unless you accept that incoming SMS previews may be forwarded to another channel and the shell-based forwarding path has been fixed or contained. Use a dedicated browser profile, pair only on a trusted machine, avoid forwarding authentication codes or sensitive conversations, and keep notifications disabled unless you have explicitly configured a trusted destination.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares only tool/bin/env requirements in metadata but also documents behavior that depends on networked communications and a local HTTP server, which expands its effective capability surface beyond a simple browser automation skill. Undeclared network and environment-driven behavior reduces transparency for reviewers and users, making it easier to hide data exfiltration paths such as forwarding SMS previews to external channels.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose says the skill can send and receive SMS/RCS and assist with normal texting tasks, but the described implementation also includes a webhook server and forwarding of incoming SMS previews to third-party channels like Telegram. That mismatch is dangerous because users may authorize a routine messaging skill without realizing it can relay message contents externally, creating a covert data exfiltration and surveillance risk.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The server forwards SMS metadata and message content to an external OpenClaw target, which expands the skill from interacting with Google Messages into cross-channel exfiltration of private communications. In an SMS skill, this is especially sensitive because incoming texts commonly contain authentication codes, personal data, and confidential conversations, and the forwarding occurs without authentication or strong user-consent controls in this file.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code invokes a local CLI subprocess via execSync to relay message content, introducing unnecessary command-execution capability into a webhook that processes untrusted input. Although the code escapes double quotes and newlines, it still constructs a shell command from environment-controlled and request-derived data, increasing the risk of command injection, misuse of local privileges, and unexpected side effects on the host.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README explicitly promotes forwarding incoming SMS to Telegram, WhatsApp, or other channels, which can expose sensitive message content, phone numbers, and verification codes to additional services and recipients. In a messaging skill, this is especially risky because SMS often carries personal data and one-time passcodes, yet the documentation does not warn users about privacy implications, access controls, or safe-use constraints.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill describes forwarding incoming SMS notifications to other channels but does not provide a prominent user-facing warning that message previews may be transmitted outside Google Messages to services like Telegram. Because SMS often contains sensitive content such as one-time codes, personal messages, and account alerts, silent forwarding materially increases privacy and account-compromise risk.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The instructions explicitly inject a browser-side observer that monitors incoming Google Messages conversations and forwards message previews, contact names, and timestamps to a local webhook endpoint. Even though the destination is localhost, this is still an undisclosed exfiltration path for sensitive SMS/RCS data, and the document provides no consent flow, privacy warning, data minimization, or access-control guidance for handling highly sensitive communications.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The snippets are designed to extract conversation previews and recent message bodies directly from the Google Messages web UI and return them as JSON, but the file provides no user-facing privacy warning, consent requirement, or data-minimization guidance. In a messaging skill, this increases the chance that sensitive SMS/RCS content is exposed to the agent, logs, or downstream channels beyond what the user expected.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The script automatically exfiltrates SMS metadata and message preview content to a webhook endpoint whenever it detects a new incoming message, with no user-facing consent, approval step, or visibility in the Google Messages UI. Because SMS often contains sensitive data such as one-time codes, personal conversations, and account recovery information, silently forwarding even previews creates a significant confidentiality risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: SMS contents are transmitted to an external notification channel without any explicit user-facing disclosure or consent mechanism in the implementation. This creates a privacy breach risk because a user may reasonably expect messages to remain within Google Messages, while the skill silently republishes potentially sensitive content such as OTPs, account alerts, and personal conversations.

Context Leakage

High

• Category: Data Exfiltration

Content

}
  
  /**
   * Extract conversation data from the DOM
   */
  function getConversations() {
    const convos = [];

• Confidence: 85% confidence
• Finding: Extract conversation

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: sms-webhook-server.js:51