Security audit

GroupMe

Security checks across malware telemetry and agentic risk

Overview

This is a coherent GroupMe channel plugin that needs expected chat and token access, with privacy and credential handling considerations clearly worth reviewing.

Before installing, make sure group participants understand that recent messages may be buffered for context even when the bot only responds on mention. Use SecretRefs for the GroupMe access token and callback token in production, keep the callback URL secret, expose only the GroupMe webhook path, and set historyLimit: 0 if passive buffering is not acceptable.

VirusTotal

62/62 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/src/channel.js:97
Evidence: updates.accessToken = [REDACTED]();

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/src/config-schema.js:63
Evidence: accessToken: [REDACTED],

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/src/send.js:264
Evidence: accessToken: [REDACTED],

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/channel.ts:127
Evidence: if (input.accessToken?.trim()) updates.accessToken = [REDACTED]();

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/config-schema.ts:75
Evidence: accessToken: [REDACTED],

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/send.ts:360
Evidence: accessToken: [REDACTED],