Whatsapp Context Manager for Agents

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:44 PM UTC
• Version: 0.1.0

Overview

This skill appears purpose-built for WhatsApp support context management, but it stores and exposes sensitive customer conversations with weak privacy safeguards and overstated security claims.

Review before installing in any real customer-support environment. Use only with explicit privacy review, restrict database and log access, add retention/deletion policies, avoid exporting full context objects, redact identifiers in logs, and pin/verify the exact source version before running scripts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:31

Finding

Unpinned Remote Repository Is Downloaded and Its Code Is Executed

Content

View full analysis

Remediation

View remediation

git verify-commit python test_whatsapp.py ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: whatsapp_context_manager.py:403

Finding

Sensitive Customer and Conversation Data Is Stored and Logged in Plaintext

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · whatsapp_context_manager.py (reported line 889)May include surrounding context.

python

"""Record outbound message from agent"""
        customer = self.db.get_customer_by_phone(phone)
        if not customer:
            self.logger.warning(f"Attempted to send message to unknown customer: {phone}")
            return
        
        message = Message(

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill describes processing, storing, and displaying sensitive customer context such as phone numbers, order details, sentiment, tags, notes, and conversation history, but it does not warn about privacy obligations, retention limits, or access controls. In a customer-support context, this omission can lead adopters to deploy broad local data collection and agent visibility without consent handling, minimization, or deletion practices, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The web/API integration example returns the full context object as JSON, which likely includes customer profile data, message history, sentiment, notes, and order information, but the documentation does not warn that this expands the exposure surface. If copied into production, this pattern can unintentionally leak sensitive customer data to frontends, logs, unauthorized users, or poorly protected API consumers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example explicitly serializes the full customer context to JSON and promotes using it for API responses, logging, analytics, and machine learning training data. In a WhatsApp/customer-support context, that context likely contains personal data such as phone numbers, names, email addresses, message history, order details, and sentiment metadata, so encouraging broad export without minimization, masking, consent, or retention guidance can lead to privacy breaches and secondary misuse.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module markets itself as "secure," but it stores customer PII and full message contents in a local SQLite database and logs phone numbers without encryption, access controls, masking, retention limits, or consent handling. In a WhatsApp customer-support context, this can mislead adopters into deploying the component in regulated environments while exposing sensitive customer communications and identifiers to local compromise or accidental disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Incoming message content is persisted verbatim to the messages table, which creates a durable store of potentially sensitive communications such as payment disputes, personal details, and support history. In this skill's context, persistent storage is core functionality, but the absence of disclosure, minimization, encryption, or data-handling safeguards makes the privacy exposure real if the host system is accessed by unauthorized users or backups are leaked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code logs phone numbers when processing messages, creating customers, sending messages, and updating records, which exposes PII in application logs that are often broadly accessible and long-lived. In a customer-service messaging system, logs can easily become a secondary data leak path, especially in shared hosting, centralized logging, or support-debugging environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This code creates a local SQLite test database and later deletes it as part of the installation check. Although the script prints that it is running a quick functionality test, it does not explicitly disclose that a file will be written to and removed from the working directory.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.