ClawHub
Back to skill

Security audit

pidgesms

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed SMS helper that uses the pidge CLI to send and read texts, with appropriate cautions for real messages and private content.

Install only if you trust the pidge project and your Android SMS gateway setup. Consider pinning pidge to a reviewed release instead of `@latest`, and treat inbox reads and sends as sensitive actions involving real phone numbers and private messages.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:10
Finding

Unpinned Third-Party Executable Dependency

Content
View full analysis

Vulnerability Details

File Locations: SKILL.md:10 and README.md:16
Vulnerability Type: Supply-chain risk caused by a mutable, unpinned dependency
Risk Level: Medium

Vulnerable code in SKILL.md:10:

text
"install": "go install github.com/typhonius/pidge@latest",

Vulnerable code in README.md:16:

bash
go install github.com/typhonius/pidge@latest

Technical Analysis

The installation instructions use the mutable @latest version selector to download and build a third-party executable directly from GitHub. Consequently, the installed source can change after this skill has been reviewed. The project does not pin a reviewed release or document an expected module checksum.

An attacker who compromises the upstream repository, its release process, or an account authorized to publish module versions could introduce malicious code into a later release. Users following the documented command would then build and install that code under their local account without any corresponding change to this audited project.

This is a supply-chain weakness rather than evidence that the current upstream dependency is malicious.

Attack Path

  1. An attacker compromises the upstream pidge repository, release pipeline, or publisher account.
  2. The attacker publishes a malicious version that resolves through @latest.
  3. A user follows the project's installation instructions.
  4. Go retrieves, compiles, and installs the mutable malicious release.
  5. The installed executable runs with the user's privileges when the skill invokes it.
  6. The executable can potentially access the SMS data and gateway configuration available to that user.

Impact Assessment

Successful exploitation would provide code execution with the privileges of the user who installs or invokes pidge. Within that user's accessible scope, a compromised executable could read or alter ~/.config/pidge/config.toml, acc ...[truncated 371 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with a reviewed, immutable semantic version:
    bash
    go install github.com/typhonius/pidge@vX.Y.Z
  2. Pin the same version consistently in both SKILL.md and README.md.
  3. Record and verify the expected Go module checksum through a controlled go.sum or equivalent integrity-verification procedure.
  4. Review dependency source and release provenance before updating the pinned version.
  5. Adopt a controlled upgrade process that tests new releases and documents security-relevant changes before modifying the pin.
  6. Where supported, require signed releases or verifiable build provenance and distribute hashes for approved binaries.
  7. Run the executable with only the filesystem and network permissions required to communicate with the configured SMS gateway.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.