Security audit

Imessage Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent with its iMessage purpose, but it exposes sensitive Messages access and remote-control/message-sending paths with real safety weaknesses.

Install only if you are comfortable granting a skill access to your local Messages database and the ability to send iMessages. Keep remote control disabled unless you have reviewed the code, avoid adding broad admin contacts, do not rely on force=true, and prefer a version with escaped AppleScript arguments, replay protection, pinned npx usage, and stronger warnings before enabling remote command handling.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/main.py:436
Finding: AppleScript Injection Through Unescaped Message, Recipient, and File Path Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/main.py:425
Finding: Caller-Controlled Force Flag Bypasses Message Authorization and Rate Limits
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:586
Finding: Previously Processed iMessage Commands Are Re-executed on Every Poll
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/main.py:390
Finding: Unpinned Package Execution Through npx Creates Supply-Chain Exposure
Content: View full analysis
dict: try: result = subprocess.run( ['npx', 'clawhub', 'list'], capture_output=True, text=True, timeout=10 ) ``` The installation documentation likewise uses an unpinned package reference: ```bash npx clawhub install imessage ``` ### Technical Analysis No exact package version or integrity value is specified. `npx` may resolve a package from the local environment or retrieve it from the configured npm registry when it is not already installed. The effective executable can therefore change after this skill has been reviewed. This invocation is also reachable through the allowed remote-control command `!list`. If remote control is enabled and an administrator sends that command, the skill executes `npx clawhub list`. The Python process applies a timeout, but a timeout does not establish package authenticity or prevent package installation hooks and startup code from running. The audit did not identify evidence that the current `clawhub` package is malicious. The finding concerns unsafe, mutable dependency resolution and execution. ### Attack Path 1. The expected `clawhub` executable is unavailable locally, stale, or resolved through an attacker-influenced npm configuration or registry. 2. A user follows the documented installation command, or an authorized remote administrator invokes `!list`. 3. The skill starts `npx clawhub ...` without an exact version or integrity constraint. 4. `npx` resolves the package from the active npm environment and may download it. 5. Package-controlled code executes under the account running the skill. 6 ...[truncated 683 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (17)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Incoming messages can cause local subprocess execution (openclaw status, npx clawhub list) through the control-command path. This gives remote message senders an execution-trigger capability on the host that is not necessary for ordinary messaging and could be abused for reconnaissance, automation, or as a stepping stone if adjacent controls are weak.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill processes inbound iMessages and can automatically execute control commands and send replies, which is significantly broader than simple messaging functionality. Even with admin and allowlist checks, this creates a remote command channel into the host application based on message content, increasing the risk of abuse, misconfiguration, or unauthorized control if trust assumptions fail.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README advertises sending messages, viewing recent messages, and listing contacts, but does not warn users that the skill accesses privacy-sensitive communications and contact data. Without clear disclosure, users may grant Messages/accessibility permissions without understanding the scope of data exposure, increasing the chance of unintended collection, transmission, or misuse of personal information. The context makes this more concerning because iMessage content and contacts are highly sensitive and the skill explicitly enables read/send operations.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The README instructs users to run npx clawhub install imessage without pinning a specific package version. This creates a supply-chain risk because users may fetch a newly published or compromised package version at install time, and npx executes remote package code in the local environment. In a skill that can access Messages and requires accessibility permissions, compromise of the installer path is more dangerous because the resulting code may gain access to sensitive communications.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file presents all operational and safety instructions in Chinese, including setup, warnings, and usage examples, but does not indicate that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific audience. This can violate a language/locale policy when users are not given an opt-in or alternative locale.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The installation instruction uses npx clawhub install imessage without pinning an exact package version, so users may fetch whatever version is current at install time. For a skill that can access Messages, send messages, and potentially enable remote control, an unexpected upstream package change or supply-chain compromise could materially change behavior at install or execution time.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation asserts strong remote-control protections via whitelist/blacklist enforcement, but the documented flow does not actually demonstrate that these checks are complete or correctly ordered, and blacklists are especially weak as a security boundary. In a skill whose stated feature is controlling OpenClaw via incoming iMessage, overstated safety guarantees can lead operators to enable a capability that permits unauthorized or overly broad command execution.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The module description presents the skill as a secured messaging integration, but the implementation also supports host control and command execution. This mismatch can mislead users or reviewers about the true capability set, making risky behavior easier to enable without informed consent.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/main.py (reported line 354)May include surrounding context.
python
def _cmd_status(self) -> dict: """获取 OpenClaw 状态""" try: result = subprocess.run( ['openclaw', 'status'], capture_output=True, text=True,

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/main.py (reported line 392)May include surrounding context.
python
def _cmd_list(self) -> dict: """列出 skills""" try: result = subprocess.run( ['npx', 'clawhub', 'list'], capture_output=True, text=True,

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 97% confidence
Finding: The code interpolates untrusted phone and message values directly into AppleScript source and executes it via osascript. An attacker who can influence those fields can break out of the quoted AppleScript strings and inject arbitrary AppleScript, potentially causing unintended local actions under the user's context.
Content: Scanner excerpt · scripts/main.py (reported line 444)May include surrounding context.
python
end tell ''' result = subprocess.run( ['osascript', '-e', applescript], capture_output=True, text=True,

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 96% confidence
Finding: image_path and phone are embedded directly into AppleScript and then executed, creating an injection sink similar to the message-sending path. If a crafted value contains quotes or AppleScript syntax, it can alter script logic and execute unintended actions on the host.
Content: Scanner excerpt · scripts/main.py (reported line 494)May include surrounding context.
python
end tell ''' result = subprocess.run( ['osascript', '-e', applescript], capture_output=True, text=True,

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Inbound messages can trigger automatic replies, including command results and permission errors, with no interactive warning or approval. This can leak host information to remote senders, confirm the system is active, and create unanticipated message-sending behavior that the local user did not explicitly authorize each time.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Remote control can be enabled programmatically with no strong user-facing warning about the consequences of processing incoming messages as commands. This weak consent model makes it easy for a user or higher-level automation to activate a risky feature without appreciating that message-triggered execution and auto-replies will occur.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger patterns are broad generic phrases such as 'iMessage', '发消息', and 'send message', which are likely to match ordinary conversation or unrelated user requests. Because this skill exposes an exec-capable entry point and can interact with Messages on macOS, accidental invocation could lead to unintended message access or message-sending flows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The primary descriptive text is presented in Chinese, while the rest of the surrounding ecosystem cues are otherwise generic and do not state that the skill is intended only for Chinese-speaking users or a China-specific deployment. This creates a language/locale constraint without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 73% confidence
Finding: The natural-language metadata presented to users is written in Chinese, including the description and usage note, with no indication that other languages are supported or that the locale is intentionally restricted. This can violate language/locale policy when users are not given a language choice or explicit justification for the constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.