ClawAudit verdict

bluebubbles-healthcheck

88
🟢 Trusted
Low risk — reviewed by ClawAudit, behavior matches stated purpose

Diagnostic and auto-healing tool for BlueBubbles iMessage connectivity that makes curl calls to localhost and runs local scripts; all operations are local network health checks with no external data exfiltration.

⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.

Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.

0
security
80
transparency
70
maintenance

Findings (6)

Pattern match critical

Possible hardcoded credential

SKILL.md · code · PASSWORD="your-password

Pattern match high

HTTP request to bare IP address — common in malicious payloads

SKILL.md · code · http://127.0.0.1

Pattern match high

Pipe to python — executes piped content as Python code

scripts/diagnose.sh · prose · downgraded · | python3

Pattern match high

Pipe-to-python pattern — remote code execution risk

scripts/diagnose.sh · prose · downgraded · curl -s --max-time 5 -H "Authorization: Bearer ${BB_PASSWORD}" "${BB_URL}/api/v1

Pattern match medium

Instructs covert action — may act without user awareness

README.md · prose · downgraded · silently

Pattern match low

References webhook/callback URL

SKILL.md · prose · downgraded · WEBHOOK_URL

Why the tier is capped

Execution sink present in raw bytes (Hard Floor: class B/C). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.

Permissions & capabilities

Requires 4 system binaries. (1 elevated: curl).

network_in

Is this flag fair?

Check another skill Browse the registry Auditing your own skills or configs? Use the API