google-messages

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The code intentionally captures SMS content from a logged-in Google Messages web session and forwards it (via a configurable webhook or the OpenClaw CLI) and includes CDP/WebSocket-based injection and runtime evaluation—this provides a clear data-exfiltration capability (with explicit filtering to omit OTPs), and can be abused as a backdoor to siphon sensitive messages to arbitrary external endpoints.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow injects sms-observer.js into the authenticated messages.google.com page and then the agent polls window._smsObserver.getPending(); the pending queue contains outsider-authored free text (incoming SMS/RCS message content and contact names) extracted from the DOM and returned to the agent for forwarding.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The inject script (scripts/inject-observer.sh) auto-runs npm install to fetch the "ws" dependency which will download and install the package from https://registry.npmjs.org/ws/-/ws-8.19.0.tgz and that module is executed by the Node injection code, so remote code is fetched at runtime and executed locally.