SocialKit WhatsApp Support Bot

• Outcome: Review
• Latest audit: Nov 6, 2026 · 7:12 AM UTC
• Version: 0.3.1

Overview

This support bot needs review because it ignores recorded opt-outs and can reveal order status without checking who owns the order.

Before live use, enforce STOP until explicit START and disable order lookup until it verifies customer ownership. Protect credentials and customer logs, and define a retention period. Inspection and isolated tests resolved the material scanner coverage gaps; live Meta behavior and the unbundled socialkit-social-core dependency were not verified.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/bot.mjs

Finding

Order status lookup lacks customer-level authorization

Content

View full analysis

Impact

A sender who knows or guesses another customer's order ID can obtain its status. Repeated requests can enumerate statuses for matching order IDs.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

1. `node scripts/bot.mjs --init --dir wa-bot`

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

3. `node scripts/bot.mjs --check --dir wa-bot`, then try messages:

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

`node scripts/bot.mjs --test "what time do you open?" --dir wa-bot`

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

`node scripts/bot.mjs --approve --dir wa-bot`

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

5. Run: `node scripts/bot.mjs --serve --dir wa-bot --port 8787`, expose it over HTTPS

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bot.mjs (reported line 357)May include surrounding context.

js

function defaultHint(error) {
  switch (error.code) {
    case 190:
      return "The access token is expired or invalid. Re-run the auth script for this platform.";
    case 4:
    case 17:
    case 32:

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, network.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Opt-outs are recorded but never enforced when sending subsequent automatic replies.

Medium

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

The handler persists opt-outs but never checks the opted-out set before sending subsequent FAQ, order, or handoff replies. This undermines the advertised unsubscribe behavior and customer consent expectations, although the impact is limited because replies require an inbound message and an open customer-service window rather than being unsolicited broadcasts.

Content

No source excerpt is available for this finding.