ClawHub
Back to skill

Security audit

Wacrawl

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned, but it asks users to run an unpinned third-party binary with Full Disk Access and to duplicate private WhatsApp chats into a persistent local archive.

Review this before installing. Only run it if you are comfortable granting Full Disk Access to the terminal and creating a second local database of your WhatsApp history. Prefer a pinned or auditable wacrawl release, protect ~/.wacrawl with strict local permissions, consider whether backups will capture the archive, and remove both the archive and any schedule when you no longer need it.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:15
Finding

Excessive Full Disk Access for Processing Sensitive WhatsApp Data

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:5
Finding

Unpinned Privileged Binary Installed from a Third-Party Homebrew Tap

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
Local read-only mirror of WhatsApp Desktop on macOS. Copies WhatsApp's SQLite databases into a temp snapshot, imports useful chat data into its own archive, and exposes scriptable search.

**Does not** send messages, decrypt cloud backups, talk to WhatsApp Web, or write back into WhatsApp's app container.

## Requirements
- macOS with **WhatsApp Desktop** (Mac App Store version) installed and signed in.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill clearly states that wacrawl import copies WhatsApp SQLite data into ~/.wacrawl/wacrawl.db, but it does not present this as an explicit privacy warning or emphasize that highly sensitive message content is being duplicated into a second persistent archive. This increases the risk that a user enables full-disk access and runs the import without fully understanding the creation of an additional local datastore containing private chats, attachments metadata, and searchable history.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.