ClawHub
Back to skill

Security audit

Beeper

Security checks across malware telemetry and agentic risk

Overview

This skill gives an agent read-only access to local Beeper chat history, which is sensitive but clearly disclosed and aligned with its purpose.

Install only if you are comfortable letting your agent read Beeper conversations that may include sensitive messages from connected chat services. Use it for specific searches or threads, avoid broad exports, and review any chat excerpts before sharing them outside your machine.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Context Leakage

High
Category
Data Exfiltration
Content
[Beeper](https://www.beeper.com/) is a universal chat app that unifies messages from WhatsApp, Telegram, Signal, iMessage, Discord, and more in a single inbox.

This skill provides **read-only access** to your local Beeper chat history. Browse threads, search messages, and extract conversation data.

## Requirements
- Beeper Desktop app installed (provides the SQLite database)
Confidence
96% confidence
Finding
The skill explicitly grants an agent read-only access to a user's local Beeper chat history and advertises the ability to browse threads, search messages, and extract conversation data. Even without write access, this creates a direct path to expose highly sensitive personal and business communications from multiple messaging platforms, so the context strongly increases the severity of the leakage risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.