ClawHub
Back to skill

Security audit

Google Messages

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real Google Messages automation and forwarding tool, but it handles private SMS data with weak controls and includes a serious command-injection risk in its webhook server.

Review before installing. Only use this with SMS conversations you are comfortable forwarding outside Google Messages, avoid enabling persistent notifications until the webhook is fixed, and do not run the current webhook server with real forwarding targets because crafted message content could execute local commands.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
sms-webhook-server.js:44
Finding

Arbitrary Command Execution Through Unsafely Constructed OpenClaw CLI Command

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The skill is presented as a Google Messages send/receive automation tool, but it also introduces continuous monitoring and forwarding of incoming message data to other channels via a webhook workflow. That is materially more sensitive than ordinary browser automation because it can export SMS content or previews outside the original messaging context without sufficiently explicit capability declaration and privacy framing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill is presented as a Google Messages send/receive automation tool, but it also introduces continuous monitoring and forwarding of incoming message data to other channels via a webhook workflow. That is materially more sensitive than ordinary browser automation because it can export SMS content or previews outside the original messaging context without sufficiently explicit capability declaration and privacy framing.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The document instructs users to inject JavaScript into the Google Messages web UI that monitors conversations and automatically POSTs message metadata and preview text to a webhook. This creates continuous exfiltration of private SMS/RCS content without any meaningful consent, privacy warning, data minimization, or transport protection, making disclosure of sensitive communications likely.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The instructions plainly set up persistent surveillance of incoming messages by attaching a MutationObserver and periodic polling, then forwarding detected message previews to a local webhook server. Even though the destination is localhost, this still enables covert collection and secondary exposure of highly sensitive SMS data, and the skill context normalizes the behavior without warning users about the privacy and security consequences.

Content

No source excerpt is available for this finding.

Context Leakage

High
Category
Data Exfiltration
Confidence
75% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · sms-observer.js (reported line 39)May include surrounding context.

js
}
  
  /**
   * Extract conversation data from the DOM
   */
  function getConversations() {
    const convos = [];

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script automatically exfiltrates SMS metadata and message preview content to a webhook whenever it detects a new inbound message. In the context of a messaging skill, this is highly sensitive data flow, and the code provides no in-script consent gate, origin restriction, authentication, or user-visible warning before forwarding private communications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly promotes forwarding incoming SMS to Telegram, WhatsApp, or other channels, but it does not clearly warn that message contents and metadata may be disclosed to third-party services outside Google Messages. Because SMS often contains sensitive personal or authentication-related information, users may enable forwarding without understanding the privacy consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The notification setup walks the user through exporting a notification target and starting a webhook server, but it does not warn that enabling this feature may automatically relay incoming SMS/RCS data to another service. In this skill context, the omission is more dangerous because the instructions are operational and likely to be copied directly, increasing the chance of unintentional message-content exfiltration.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 88)May include surrounding context.

cp systemd/google-messages-webhook.service ~/.config/systemd/user/

Edit service file: uncomment and set Environment= lines

systemctl --user daemon-reload systemctl --user enable --now google-messages-webhook

text

## How It Works

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares browser/node/env requirements in metadata and documents running a local webhook server plus forwarding SMS notifications to external channels, but it does not define an explicit tool/permission scope for those capabilities. That weakens least-privilege controls and makes sensitive actions like reading environment variables and transmitting message-derived data harder to audit or constrain.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly supports forwarding incoming SMS notifications to other channels, yet the security section only mentions localhost listening and QR sensitivity, not the privacy risks of transmitting message content, sender information, or previews to third-party services. Users may enable forwarding without understanding that highly sensitive SMS data could leave the Google Messages environment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

The documented systemd user service enables the webhook server to run persistently, which increases exposure duration for message monitoring and forwarding and makes accidental long-term surveillance more likely. Persistence is not inherently malicious, but in the context of SMS-derived notifications it raises the chance that sensitive data continues flowing after the user forgets it is enabled.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

cp /systemd/google-messages-webhook.service ~/.config/systemd/user/

Edit service file: set SMS_NOTIFICATION_TARGET in Environment=

systemctl --user daemon-reload systemctl --user enable --now google-messages-webhook

text

---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The snippets directly enumerate conversation lists and message bodies from Google Messages and return them as structured output, which exposes highly privacy-sensitive SMS/RCS content. In a messaging skill this access is functionally expected, but the lack of explicit user-facing warning, consent gating, and data-minimization guidance increases the risk of over-collection or unintended disclosure of personal communications.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly forwards SMS/RCS content from Google Messages into other OpenClaw channels, which expands its capabilities from message access into cross-channel exfiltration of sensitive communications. Even though this appears to be an advertised feature rather than stealthy malware, SMS content commonly contains OTPs, personal data, and private conversations, so automatic forwarding materially increases data exposure risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code builds a shell command string using untrusted SMS-derived fields (data.contact, data.preview, data.message) and executes it with execSync, creating a command injection sink. Any local process or browser script able to POST to the localhost webhook can supply crafted JSON that escapes quoting and executes arbitrary OS commands under the server's privileges, while also forwarding sensitive SMS data to external channels.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
sms-webhook-server.js:51