Unbridled

Send and read messages on Facebook Messenger, WhatsApp, Instagram, LinkedIn, Twitter/X, Signal, Telegram, Discord and other networks through a Beeper account...

This skill appears to do what it says (use your Beeper account as a unified API) but it requires highly sensitive secrets: the Beeper Recovery Key (full account recovery and decryption of message history) and the bbctl access token (API access). If you install it, you will be asked to store those secrets on the agent host (plaintext file and bbctl config) and to run an optional systemd user daemon that continuously syncs keys and messages. Before installing, consider: - Only install on a host you fully control and trust (use an isolated VM/container or a dedicated agent user). - Understand that the recovery key + bbctl token = read+write access to all bridged networks (inbox history + sending). Treat them like root passwords. If leaked, rotate/regenerate the recovery key from Beeper Desktop and revoke the device. - If you only need to send messages and can accept not reading history, skip importing the recovery key and decline installing the sync daemon — functionality will be reduced but risk is lower. - Verify the scripts yourself (they are provided) and inspect any changes before running. The install steps download bbctl from the project's GitHub releases and pip packages from PyPI — standard but run them in a controlled environment if you're cautious. - Audit and cleanup steps are provided in the README; after testing you can remove ~/.local/share/clawd-matrix, ~/.config/bbctl, and the recovery key file to revoke local access. Keep an eye on the user systemd unit and logs (journalctl --user -u clawd-beeper-sync). The skill is coherent with its purpose, but because it requires full decryption keys, treat it as high-trust and follow the precautions above.

Type: OpenClaw Skill Name: unbridled Version: 0.2.2 The skill provides unified access to a user's Beeper/Matrix messaging accounts, including E2EE networks like WhatsApp and Messenger. It requires the user to store their master Beeper Recovery Key in a local file (~/.secrets/beeper-recovery-key.txt) and uses it to bootstrap cross-signing and decrypt historical message backups (scripts/bootstrap_crosssign.py and scripts/import_key_backup.py). While the code appears well-documented, follows the Matrix specification (including handling known libolm implementation quirks), and includes safety instructions for the AI agent, the inherent high-risk nature of automating access to a master recovery key and all private communications across multiple platforms warrants a suspicious classification under the provided criteria.