Security audit

iMessage

Security checks for vulnerabilities and agentic risk

Overview

The plugin fits its iMessage purpose, but it grants powerful Messages access and can perform some visible/private-API actions automatically once configured.

Before installing, treat this as giving OpenClaw access to your signed-in Messages account. Use pairing or allowlists, keep group access narrow, review action gates for edits/unsends/group changes, and disable sendReadReceipts if automatic read receipts are not acceptable.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · skills/imsg/SKILL.md (reported line 247)May include surrounding context.
md
- Confirm recipient, chat, and content before every send unless the user's request already contains exact values. - Confirm visible state changes: read receipts, typing indicators, edits, unsends, deletes, poll votes, tapbacks, group membership, group name/photo, leaving/deleting chats. - Never send to unknown numbers or ambiguous contact-name matches without approval. - Confirm attachments exist and are the intended files. - Prefer E.164 phone numbers; use `--region US` or another region only when needed for local formats. - Use bridge actions for bridge-only semantics, but confirm visible state changes and destructive actions first.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/.setup/sanitize-outbound-3MLljgtY.mjs:600
Evidence: const child = spawn(this.cliPath, args, { stdio: [

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/.setup/monitor-fv9nRuTH.mjs:3095
Evidence: const storeAllowFrom = await readChannelAllowFromStore("imessage", process.env, accountInfo.accountId).catch(() => []);