Whatsapp Context Manager for Agents

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:44 PM UTC
• Version: 0.1.0

Overview

This skill appears purpose-built for WhatsApp support context management, but it stores and exposes sensitive customer conversations with weak privacy safeguards and overstated security claims.

Review before installing in any real customer-support environment. Use only with explicit privacy review, restrict database and log access, add retention/deletion policies, avoid exporting full context objects, redact identifiers in logs, and pin/verify the exact source version before running scripts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:31
• Finding: Unpinned Remote Repository Is Downloaded and Its Code Is Executed<![CDATA[ ## Vulnerability Details **File Location**: `README.md:31-35` **Vulnerability Type**: Supply-chain risk from mutable remote source **Risk Level**: Medium ### Vulnerable Code ```bash # Clone the repository git clone https://github.com/cerbug45/whatsapp-context-manager.git cd whatsapp-context-manager # No dependencies needed - pure Python standard library! python test_whatsapp.py # Verify installation ``` ### Technical Analysis The documented installation procedure clones the current default branch of a remote Git repository and then executes `test_whatsapp.py`. That script imports `whatsapp_context_manager.py`, so importing the module also executes its module-level code. The instructions do not pin an immutable commit, verify a signed release, or validate a cryptographic checksum. Consequently, the code users execute may differ from the version that was audited. Although no malicious code was identified in the reviewed artifact, compromise of the repository, maintainer account, or release process could change the effective payload after review. ### Attack Path 1. An attacker compromises the referenced repository, its maintainer account, or the upstream delivery process. 2. The attacker modifies `test_whatsapp.py`, `whatsapp_context_manager.py`, or another imported file on the default branch. 3. A user follows the documented `git clone` instructions without selecting a reviewed commit. 4. The user runs `python test_whatsapp.py`. 5. Python executes the attacker-controlled test code and imported module code with the user's privileges. ### Impact Assessment Successful exploitation permits arbitrary code execution under the account running the installation test. The attacker could access or modify any files and resources available to that user, including customer databases, environment variables, source repositories, and user-owned credentials. This path does not independently provide elevated operating-system privileges; its scope is bounded by ...[truncated 39 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Instruct users to check out an immutable, reviewed commit hash rather than the mutable default branch. 2. Publish versioned release archives with SHA-256 checksums and, preferably, cryptographic signatures. 3. Require users to verify the checksum or signature before running any Python file. 4. Protect repository releases and default branches with multi-factor authentication, branch protection, mandatory review, and signed commits or tags. 5. Document the expected checksum and exact version in the installation guide. 6. Where practical, inspect the downloaded files in an isolated environment before execution. A hardened installation example is: ```bash git clone https://github.com/cerbug45/whatsapp-context-manager.git cd whatsapp-context-manager git checkout --detach <reviewed-commit-hash> git verify-commit <reviewed-commit-hash> python test_whatsapp.py ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: whatsapp_context_manager.py:403
• Finding: Sensitive Customer and Conversation Data Is Stored and Logged in Plaintext<![CDATA[ ## Vulnerability Details **File Location**: `whatsapp_context_manager.py:403-466`; related logging at `whatsapp_context_manager.py:783-786`, `797`, `918`, and `935` **Vulnerability Type**: Plaintext storage and logging of sensitive information **Risk Level**: Medium ### Vulnerable Code ```python def _initialize_database(self): """Initialize SQLite database with tables""" conn = sqlite3.connect(self.db_path) cursor = conn.cursor() # Customers table cursor.execute(""" CREATE TABLE IF NOT EXISTS customers ( customer_id TEXT PRIMARY KEY, phone TEXT UNIQUE NOT NULL, name TEXT, email TEXT, is_vip INTEGER DEFAULT 0, tags TEXT, notes TEXT, created_at TEXT NOT NULL, last_contact TEXT, total_messages INTEGER DEFAULT 0, avg_response_time REAL DEFAULT 0.0, sentiment_history TEXT ) """) # Messages table cursor.execute(""" CREATE TABLE IF NOT EXISTS messages ( message_id TEXT PRIMARY KEY, customer_id TEXT NOT NULL, content TEXT NOT NULL, direction TEXT NOT NULL, timestamp TEXT NOT NULL, agent_id TEXT, category TEXT, sentiment TEXT, priority TEXT, metadata TEXT, FOREIGN KEY (customer_id) REFERENCES customers (customer_id) ) """) # Orders table cursor.execute(""" CREATE TABLE IF NOT EXISTS orders ( order_id TEXT PRIMARY KEY, customer_id TEXT NOT NULL, status TEXT NOT NULL, amount REAL NOT NULL, items TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, tracking_number TEXT, estimated_delivery TEXT, notes TEXT, FOREIGN KEY (customer_id) REFERENCES custom ...[truncated 3001 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create database files with owner-only permissions, such as mode `0600`, and ensure the containing directory is not accessible to unrelated users. 2. Validate that an existing database file is not a symbolic link and has acceptable ownership and permissions before opening it. 3. Use encrypted storage appropriate to the deployment threat model, such as full-disk encryption, an encrypted database implementation, or authenticated field-level encryption for high-risk fields. 4. Keep encryption keys outside the database and source tree, preferably in an operating-system credential store or managed key service. Implement key rotation and recovery procedures. 5. Redact or tokenize phone numbers in logs. For example, log only a stable internal customer ID or the final few digits where operationally necessary. 6. Configure log access controls, retention periods, secure transport, and deletion procedures. Do not allow sensitive logs to propagate to unrestricted monitoring systems. 7. Add configurable retention and deletion workflows for messages, profiles, orders, and backups. 8. Minimize collected data and avoid persisting fields not required for the customer-service function. 9. Document the security assumptions for local storage and test database permissions in automated tests. 10. Remove the unsupported SHA-256 integrity and GDPR-readiness claims, or implement verifiable integrity protection and the complete governance controls needed to substantiate them. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Exfiltration Commands

High

• Category: Prompt Injection

Content

"""Record outbound message from agent"""
        customer = self.db.get_customer_by_phone(phone)
        if not customer:
            self.logger.warning(f"Attempted to send message to unknown customer: {phone}")
            return
        
        message = Message(

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill describes processing, storing, and displaying sensitive customer context such as phone numbers, order details, sentiment, tags, notes, and conversation history, but it does not warn about privacy obligations, retention limits, or access controls. In a customer-support context, this omission can lead adopters to deploy broad local data collection and agent visibility without consent handling, minimization, or deletion practices, increasing privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The web/API integration example returns the full context object as JSON, which likely includes customer profile data, message history, sentiment, notes, and order information, but the documentation does not warn that this expands the exposure surface. If copied into production, this pattern can unintentionally leak sensitive customer data to frontends, logs, unauthorized users, or poorly protected API consumers.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The example explicitly serializes the full customer context to JSON and promotes using it for API responses, logging, analytics, and machine learning training data. In a WhatsApp/customer-support context, that context likely contains personal data such as phone numbers, names, email addresses, message history, order details, and sentiment metadata, so encouraging broad export without minimization, masking, consent, or retention guidance can lead to privacy breaches and secondary misuse.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The module markets itself as "secure," but it stores customer PII and full message contents in a local SQLite database and logs phone numbers without encryption, access controls, masking, retention limits, or consent handling. In a WhatsApp customer-support context, this can mislead adopters into deploying the component in regulated environments while exposing sensitive customer communications and identifiers to local compromise or accidental disclosure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Incoming message content is persisted verbatim to the messages table, which creates a durable store of potentially sensitive communications such as payment disputes, personal details, and support history. In this skill's context, persistent storage is core functionality, but the absence of disclosure, minimization, encryption, or data-handling safeguards makes the privacy exposure real if the host system is accessed by unauthorized users or backups are leaked.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code logs phone numbers when processing messages, creating customers, sending messages, and updating records, which exposes PII in application logs that are often broadly accessible and long-lived. In a customer-service messaging system, logs can easily become a secondary data leak path, especially in shared hosting, centralized logging, or support-debugging environments.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: This code creates a local SQLite test database and later deletes it as part of the installation check. Although the script prints that it is running a quick functionality test, it does not explicitly disclose that a file will be written to and removed from the working directory.

Static analysis

No suspicious patterns detected.