Beeper API CLI
v1.0.0Read and send messages via Beeper CLI. Supports WhatsApp, Telegram, Signal, Instagram, Twitter/X, LinkedIn, Facebook Messenger and more.
⭐ 1· 1.6k·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's stated purpose (local Beeper CLI wrapper) matches the code and instructions: it talks to a local Beeper Desktop API. However the registry metadata claims no required environment variables while the SKILL.md and beeper.sh both require BEEPER_TOKEN. The script also hardcodes a user-specific BEEPER_CLI path (/Users/ashrafali/...), which is not proportional or portable for general users.
Instruction Scope
SKILL.md sensibly documents requiring a local API token and includes a strict 'never send without explicit approval' policy. But that policy is advisory text only — the script itself simply runs the CLI and does not enforce messaging approval. The wrapper also auto-starts Beeper Desktop (open -a "Beeper Desktop") which is a side effect that may be unexpected; the auto-start is macOS-specific and not handled for Linux despite OS metadata including linux.
Install Mechanism
This is an instruction-only skill with a bundled shell wrapper; there is no install step that downloads or executes remote code. That keeps install risk low.
Credentials
The runtime requires a sensitive secret (BEEPER_TOKEN) and an optional BEEPER_API_URL, but the registry metadata declares no required env vars or primary credential — an inconsistency. Requesting a local API bearer token is reasonable for this purpose, but it should be declared and documented in metadata. The hardcoded BEEPER_CLI path further suggests this package was created for a specific user environment and may leak information about the author or simply not work for others.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and does not persist credentials itself. The main privilege/side-effect is that the wrapper will attempt to start Beeper Desktop if it is not running, which can be surprising but is not a system-level elevation.
What to consider before installing
Before installing or enabling this skill, note these points:
- The skill actually requires a BEEPER_TOKEN (a local Bearer token). The registry metadata incorrectly lists no required env vars. Only set this token if you trust the environment and understand it grants access to all messages available to your Beeper Desktop.
- The provided beeper.sh contains a hardcoded path (/Users/ashrafali/...) to the beeper CLI binary and will fail unless you edit it to point to the correct binary on your machine. Review and update BEEPER_CLI in the script before running.
- The script will try to auto-start Beeper Desktop using macOS 'open -a' if the app isn't running. That side effect can be surprising and will not work on Linux. If you don't want the skill to start apps, remove or modify that section.
- The SKILL.md enforces a 'never send without explicit approval' policy in text, but the script itself does not enforce user confirmation. If you will allow agent automation, ensure the agent is configured so it cannot send messages without explicit, verifiable user approval.
- Verify Beeper Desktop API settings: ensure the API token is restricted to localhost (or that allowed IPs are configured appropriately) before using the skill from another machine.
- If you want to proceed: (1) inspect and edit beeper.sh to point to your beeper binary and remove/adjust the auto-start behavior, (2) export BEEPER_TOKEN and set BEEPER_API_URL to the local API, and (3) test read-only commands first (list chats, read messages) before enabling any send workflows.
This skill appears to implement its stated purpose, but the metadata/script mismatches and side-effects warrant manual review and configuration before use.Like a lobster shell, security has layers — review code before you run it.
latestvk97a65hfy2r94dantb1pv9674s800vx8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
💬 Clawdis
OSmacOS · Linux
