ClawHub
Back to skill

Security audit

Beeper

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it lets an agent search local Beeper chat history, which is sensitive but clearly related to the skill's purpose.

Install only if you want an agent to read and summarize your local Beeper messages. Use narrow searches, limit result counts, avoid unnecessary extraction of full conversations, and consider pinning or reviewing the beeper-cli version before installing because the documented install command tracks the latest upstream code.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:71
Finding

Unpinned Third-Party CLI Dependency Permits Supply-Chain Code Substitution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 71–80
Vulnerability Type: Unpinned executable dependency from a mutable upstream source
Risk Level: Medium

Vulnerable Code

bash
go install github.com/krausefx/beeper-cli/cmd/beeper-cli@latest
bash
git clone https://github.com/krausefx/beeper-cli.git
cd beeper-cli
go build ./cmd/beeper-cli
# Move beeper-cli to PATH, e.g., /usr/local/bin

Technical Analysis

Both documented installation methods obtain executable source from mutable upstream references. The recommended command uses @latest, while the alternative builds the repository's unpinned default branch. Neither method pins a reviewed release or commit, verifies a checksum, nor validates a cryptographic signature.

Consequently, the code installed by users can differ from the code present when this Skill was audited. Although the documentation claims that the CLI provides read-only access, this repository contains no local implementation that can independently establish or enforce that property.

Attack Path

  1. An attacker compromises the upstream repository, maintainer account, module publication process, or another relevant supply-chain component.
  2. The attacker publishes a malicious revision selected by @latest or places malicious code on the repository's default branch.
  3. A user follows one of the installation procedures in SKILL.md.
  4. Go downloads and compiles the substituted source, producing an attacker-controlled executable.
  5. The user or agent invokes beeper-cli to browse or search local chat data.
  6. The malicious executable runs with the invoking user's privileges and can access resources available to that user, including the Beeper databases involved in the intended workflow.

Impact Assessment

Successful exploitation enables arbitrary code execution with the privileges of the user who installs or invokes the CLI. The accessible scop ...[truncated 396 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with a specific, reviewed semantic version or immutable commit identifier.
  2. Pin the source-build procedure to the same reviewed release tag or full commit hash rather than building the default branch.
  3. Publish and verify cryptographic checksums for expected source archives or binaries before installation.
  4. Where supported, verify signed release tags, commits, provenance attestations, or package signatures against a documented trusted maintainer identity.
  5. Record the approved version and expected digest in SKILL.md so installations are reproducible.
  6. Review dependency lock information and the complete transitive dependency graph for the pinned revision.
  7. Run the CLI with least privilege and restrict its filesystem and network access where practical, particularly when processing sensitive chat databases.
  8. Establish a controlled update process in which new upstream versions are reviewed and their hashes deliberately updated rather than selected automatically.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly enables searching and extracting local chat history across multiple messaging platforms, but it does not warn users that highly sensitive personal and business communications may be exposed to the agent. In an agent context, omission of a privacy warning increases the risk of over-collection and inadvertent disclosure because users may invoke the skill without understanding the scope of accessible data.

Content

No source excerpt is available for this finding.

Context Leakage

High
Category
Data Exfiltration
Confidence
89% confidence
Finding

The phrase 'extract conversation data' reflects a real capability to retrieve message contents from a local aggregated chat database, which can include private conversations from WhatsApp, Signal, iMessage, Discord, and other services. Even though the tool is described as read-only, confidentiality impact remains high because an agent can still surface, summarize, or exfiltrate sensitive communications once granted access.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
[Beeper](https://www.beeper.com/) is a universal chat app that unifies messages from WhatsApp, Telegram, Signal, iMessage, Discord, and more in a single inbox.

This skill provides **read-only access** to your local Beeper chat history. Browse threads, search messages, and extract conversation data.

## Requirements
- Beeper Desktop app installed (provides the SQLite database)

Static analysis

No suspicious patterns detected.