textme

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This README documents an intentional remote-control daemon that provides remote code execution via inbound SMS/iMessage (gated only by a phone-number whitelist) and stores/send API credentials—creating a high-risk backdoor and exfiltration surface usable by an attacker who controls or spoofs a whitelisted number.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md describes that the required runtime daemon polls Sendblue for inbound iMessages and routes any message from a whitelisted phone—“anything else is treated as a Claude prompt”—directly into a Claude Code session, so outsider-authored free text can be submitted via the messaging queue/feed the daemon reads.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs the user to git-clone and run the remote repository (https://github.com/njerschow/textme.git), which fetches and installs third-party code that is then executed as the daemon that drives Claude and can execute commands on the host.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly installs a persistent daemon that grants remote code execution and filesystem access via inbound SMS (whitelisted phone numbers) and instructs enabling persistent services (pm2 startup / install-launchd.sh), which directly modifies the host state and can require service-level changes or elevated actions.