Security audit

iMessage

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed iMessage/OpenClaw channel plugin that needs sensitive local Messages access, but its capabilities match its purpose and include clear confirmation, allowlist, and approval controls.

Install only on a Mac or configured remote Mac where you are comfortable granting OpenClaw/imsg access to Messages data and sending authority. Review allowFrom, dmPolicy, groupPolicy, private API actions, and approval routing before enabling broad or group access.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: - Confirm recipient, chat, and content before every send unless the user's request already contains exact values. - Confirm visible state changes: read receipts, typing indicators, edits, unsends, deletes, poll votes, tapbacks, group membership, group name/photo, leaving/deleting chats. - Never send to unknown numbers or ambiguous contact-name matches without approval. - Confirm attachments exist and are the intended files. - Prefer E.164 phone numbers; use `--region US` or another region only when needed for local formats. - Use bridge actions for bridge-only semantics, but confirm visible state changes and destructive actions first.
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/.setup/sanitize-outbound-o1ePXajW.mjs:542
Evidence: const child = spawn(this.cliPath, args, { stdio: [

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/.setup/monitor-CSeWJ3Qh.mjs:3146
Evidence: const storeAllowFrom = await readChannelAllowFromStore("imessage", process.env, accountInfo.accountId).catch(() => []);