BlueBubbles (tc)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:07 AM UTC
• Version: 1.0.0

Overview

This iMessage skill is purpose-aligned, but its sample configuration is too permissive and under-secures message gateway access.

Review before installing. Use an explicit allowlist for trusted senders, prefer HTTPS or an encrypted tunnel to the BlueBubbles server, keep the server password in a secret store, and require clear user intent before sending attachments, editing messages, or unsending messages.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:27

Finding

Wildcard Sender Authorization Permits Untrusted Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 27
Vulnerability Type: Unrestricted sender authorization
Risk Level: High

Vulnerable Code:

toml

allowed_senders = ["*"]  # Allow all senders, or list specific handles

Technical Analysis

The documented configuration authorizes every sender through the wildcard value ["*"]. This violates the principle of least privilege because possession of an explicitly approved sender identity is not required.

If this example is copied into an active gateway configuration, any person capable of messaging the associated account may be treated as an authorized sender. The precise actions available depend on the gateway and agent configuration, but the exposed functionality may include invoking agent workflows and using connected messaging capabilities.

Attack Path

1. An administrator deploys the example configuration with allowed_senders = ["*"].
2. An attacker identifies or already knows the iMessage handle associated with the gateway.
3. The attacker sends a message to that account.
4. The wildcard rule accepts the attacker without checking against a trusted-handle allowlist.
5. The attacker interacts with any gateway or agent functionality exposed to accepted senders.

Impact Assessment

An unauthorized remote sender may gain access to the functionality made available through the messaging gateway. Depending on downstream permissions, this could enable unsolicited agent requests, messaging abuse, consumption of service resources, or access to actions available to the connected agent. The repository does not establish the gateway's downstream privileges, so broader system compromise cannot be confirmed from the reviewed file alone.

Remediation

View remediation

Remediation Suggestions

• Replace the wildcard with an explicit allowlist of trusted phone numbers or iMessage handles:

  toml

  allowed_senders = ["[phone]", "[e-mail]"]
  

• Clearly label wildcard authorization as unsafe and restrict it to isolated testing, if it must be documented at all.

• Reject access by default when allowed_senders is missing, empty, or malformed.

• Normalize sender identifiers before comparison while preserving exact allowlist matching.

• Add authentication-event logging, rate limiting, and alerts for repeated unauthorized attempts.

• Regularly review and remove sender identities that no longer require access.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:25

Finding

Authenticated BlueBubbles Connection Documented over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-26
Vulnerability Type: Unencrypted transmission of credentials and message data
Risk Level: Medium

Vulnerable Code:

toml

server_url = "http://192.168.1.100:1234"  # Your BlueBubbles server URL
password = "your-server-password"

Technical Analysis

The configuration example pairs password authentication with a plaintext http:// endpoint. When used as documented, HTTP provides neither transport confidentiality nor server authentication. A network-positioned attacker could observe or alter traffic between the gateway and the BlueBubbles server.

The displayed password is a placeholder rather than a leaked credential. The vulnerability arises from encouraging authenticated communication over an unencrypted transport, which may expose the real password, message content, attachments, and API requests when a user substitutes operational values.

Attack Path

1. An administrator follows the example and configures an HTTP BlueBubbles endpoint with a real server password.
2. The gateway sends authentication and messaging traffic over the local or otherwise reachable network.
3. An attacker obtains a network-adjacent position, such as access to the same untrusted wireless or local network segment.
4. The attacker captures plaintext traffic or performs a man-in-the-middle attack.
5. Depending on the protocol's authentication implementation, the attacker may recover reusable credentials, read message data, alter requests, or impersonate the server.

Impact Assessment

Exploitation may compromise the confidentiality and integrity of credentials, message content, attachments, and messaging operations sent across the affected connection. If reusable server credentials are exposed, an attacker could access the BlueBubbles API with the privileges assigned to those credentials. The actual exposure depends on network reachability and the server's ...[truncated 25 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the example endpoint with HTTPS:

  toml

  server_url = "https://bluebubbles.example.internal:1234"
  password = "your-server-password"
  

• Require valid TLS certificate verification and hostname validation; do not recommend disabling either check.

• Use a trusted internal certificate authority or a securely configured reverse proxy when the server does not natively provide TLS.

• Where HTTPS cannot be enabled directly, place the connection inside an authenticated encrypted tunnel such as a properly configured VPN.

• Explicitly state that HTTP is suitable only for isolated development environments with no untrusted network participants.

• Store the operational password through the gateway's secret-management mechanism rather than in a version-controlled configuration file.

• Rotate the server password if it may previously have traversed an untrusted plaintext connection.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill documentation encourages sending messages and attachments through a self-hosted BlueBubbles server but does not warn that content will be transmitted to external recipients and processed by a third-party/self-hosted messaging endpoint. This can lead to unintentional disclosure of sensitive data, especially when an agent is allowed to send files from the workspace or contact arbitrary phone numbers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The overview states that the skill supports edits and unsend operations but does not warn that these actions modify or retract previously sent messages, which may be unexpected or irreversible from the user's perspective. In an agent setting, omission of this warning increases the risk of accidental tampering with communications or confusing conversation history.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.