Whatsapp

• Outcome: Review
• Latest audit: Aug 27, 2026 · 6:26 AM UTC
• Version: 1.0.0

Overview

This artifact can run a full WhatsApp channel that monitors and replies to chats, while the reviewed skill presents itself as a narrower wacli helper.

Install only if you intend to add a full WhatsApp channel that can link an account, observe inbound chats, and send replies, not merely a small wacli command helper. Use a separate WhatsApp number where possible, review dmPolicy/groupPolicy/allowFrom before enabling, keep messageReceived hooks off unless needed, and assume message content and media metadata may be processed or logged locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no permissions even though it clearly instructs use of a shell-executed external binary (`wacli`) and references environment-dependent state such as `~/.wacli`. Hidden or undeclared shell capability is dangerous because it can surprise the host platform's trust and permission model, enabling message sending, history access, and account sync without transparent authorization boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The README materially misrepresents the skill as an active WhatsApp Web chat plugin that lets agents monitor and reply to chats, while the stated scope is limited to third-party messaging or history sync/search via wacli and explicitly excludes normal active chats. This mismatch can cause users or downstream agents to enable broader, more privacy-invasive behavior than intended, increasing the risk of unauthorized monitoring or messaging.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: Telling users to configure chats that agents should monitor and reply to directly contradicts the declared restriction against normal active chats. In a messaging integration context, that contradiction is dangerous because it encourages autonomous access to private communications and could lead to unintended surveillance or unapproved outbound messages from a linked account.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The runtime exposes a WhatsApp "react" action even though the skill metadata only describes sending third-party messages or syncing/searching history. This capability mismatch is dangerous because reactions are outbound actions that can alter user-visible message state and may bypass user/operator expectations, security review scope, or policy controls tied to the declared manifest behavior.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The QA driver establishes a live WhatsApp socket, waits for pending notifications, subscribes to message events, and stores normalized inbound messages including text, reactions, polls, quoted content, media metadata, sender identifiers, and phone-number-derived data. That materially expands the capability from simple outbound third-party messaging into live monitoring/history synchronization, creating a privacy-sensitive surveillance surface if exposed to tools or untrusted callers.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The exported session exposes active observation primitives such as getObservedMessages() and waitForMessage(), enabling real-time monitoring of incoming WhatsApp activity. In the context of a messaging skill, this creates an unnecessary capability for passive interception and workflow automation on private conversations beyond the stated purpose.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements a full active WhatsApp listener with reconnection, inbound processing, mention gating, reactions, and auto-reply dispatch, which materially exceeds the declared skill purpose of sending third-party messages or syncing/searching history. This capability expansion is dangerous because it grants persistent surveillance and autonomous interaction powers that a user or reviewer would not reasonably expect from the manifest, increasing the chance of covert message interception or unauthorized responses.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The code creates durable inbound journals and serializes inbound WhatsApp messages for local queue/state persistence, and elsewhere downloads inbound media to local storage. Persisting message bodies and attachments goes beyond a minimal send/search integration and creates a local cache of sensitive communications that could be exposed through filesystem access, backup leakage, or overly broad retention.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This code delivers automatic AI-generated replies to inbound WhatsApp messages, including chunking, media handling, retries, and delivery receipts. In the context of a skill described only as send/sync/search, autonomous replying is a materially different and higher-risk behavior because it can impersonate the user or agent, leak context to contacts, and trigger actions without clear operator intent.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The file transcribes inbound audio messages and substitutes the transcript into agent-processing context. This expands the scope from messaging/sync into content extraction and analysis of private voice messages, increasing privacy sensitivity and the risk that highly personal spoken content is processed, stored, or forwarded without clear user expectation.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code supports broadcasting a single inbound WhatsApp message to multiple agents for parallel or sequential processing. That behavior broadens access to potentially sensitive conversations beyond a single intended processing path, creating unnecessary data dissemination and increasing the blast radius if one agent mishandles or stores the content.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README omits a clear warning that linking a WhatsApp account could expose chat history and enable monitoring or replies involving real user conversations. In this skill context, the absence of consent and privacy warnings increases the likelihood that users will grant access without understanding the sensitivity of the data or the actions an agent may take.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The message normalization path extracts and stores sensitive message content and metadata—text, location formatting, poll data, quoted message text, reactions, media type, participant JIDs, and E.164 phone data—without any evident consent, notice, or minimization in this file. If this data is accessible to the agent or downstream systems, it can expose private communications and contact information.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: When opts.force is set, the code calls logoutWeb() to clear existing WhatsApp authentication state before starting a new login, but this file shows no explicit confirmation, warning, or proof-of-user-intent gate at the destructive step. In a messaging integration, that can let an accidental, ambiguous, or socially engineered relink request disconnect an existing session and disrupt service or replace the linked account.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The inbound logger records sender/recipient information, message body, and local media path for incoming WhatsApp messages. These logs can expose private communications and filesystem locations to operators, log processors, or anyone with log access, especially because this is a messaging integration handling sensitive personal content.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Reply-delivery logs include outbound reply text and media URLs, which may reveal sensitive generated content and external resource locations. In a WhatsApp skill, these logs can leak both user-derived context and potentially signed or private media URLs to downstream logging systems or administrators.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code loads media from arbitrary URLs and, when a readFile capability is supplied, explicitly permits local file access with `localRoots: "any"`, then forwards the loaded content to WhatsApp. In a skill whose purpose includes sending third-party WhatsApp messages, this creates a realistic exfiltration path where an agent or upstream caller can cause local or remote content to be fetched and transmitted without any user-visible consent or narrowing of permissible paths.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This code exposes multiple functions that send WhatsApp messages, reactions, stickers, polls, contacts, locations, and even presence updates without any built-in user-consent, disclosure, confirmation, or policy gating at the point of action. In the context of a skill explicitly designed to send third-party WhatsApp messages and sync/search history outside normal active chats, that omission increases the risk of covert messaging, impersonation, spam, and privacy-invasive activity if higher layers fail to enforce clear authorization and notice.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The manifest allows broadcasting inbound WhatsApp message_received hook payloads to loaded plugins without an explicit privacy warning or consent guard. In a messaging integration, that increases the risk of unnecessary disclosure of potentially sensitive message content and metadata to third-party plugin code, especially because all loaded plugins become part of the trust boundary.

Known Vulnerable Dependency: openclaw — 10 advisory(ies): CVE-2026-53846 (OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency); CVE-2026-32064 (OpenClaw's andbox browser noVNC observer lacked VNC authentication); CVE-2026-32006 (OpenClaw has a BlueBubbles group allowlist mismatch via DM pairing-store fallbac) +7 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The package depends on openclaw via workspace-based devDependencies and peerDependencies, and the provided analysis indicates multiple known advisories affecting that component. Even if some issues are host-environment dependent, shipping or developing against a version range with known critical and high-impact flaws can expose the plugin ecosystem to compromise, especially because this skill handles WhatsApp auth state and message history.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.