bluebubbles — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bluebubbles (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when working on the BlueBubbles channel plugin.
extensions/bluebubbles/ (entry: index.ts).extensions/bluebubbles/src/channel.ts.extensions/bluebubbles/src/monitor.ts (register via api.registerHttpHandler).extensions/bluebubbles/src/send.ts + extensions/bluebubbles/src/probe.ts.extensions/bluebubbles/src/runtime.ts (set via api.runtime).src/channels/plugins/catalog.ts.probeBlueBubbles in extensions/bluebubbles/src/probe.ts for health checks.sendMessageBlueBubbles in extensions/bluebubbles/src/send.ts for text delivery.resolveChatGuidForTarget in extensions/bluebubbles/src/send.ts for chat lookup.sendBlueBubblesReaction in extensions/bluebubbles/src/reactions.ts for tapbacks.sendBlueBubblesTyping + markBlueBubblesChatRead in extensions/bluebubbles/src/chat.ts.downloadBlueBubblesAttachment in extensions/bluebubbles/src/attachments.ts for inbound media.buildBlueBubblesApiUrl + blueBubblesFetchWithTimeout in extensions/bluebubbles/src/types.ts for shared REST plumbing.api.runtime) and clawdbot/plugin-sdk helpers.<media:...> placeholders when text is empty and attach media paths via MediaUrl(s) in the inbound context.channels.bluebubbles.serverUrl (base URL), channels.bluebubbles.password, channels.bluebubbles.webhookPath.channels.bluebubbles.actions.reactions (default true).react action requires a target (phone number or chat identifier) in addition to messageId. Example: action=react target=+15551234567 messageId=ABC123 emoji=❤️~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.