Whatsapp

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:19 AM UTC
• Version: 1.0.0

Overview

This is a WhatsApp integration with sensitive but disclosed WhatsApp access; the main residual risk is a mutable third-party wacli installer.

Install only if you intend to link WhatsApp to OpenClaw and are comfortable with local WhatsApp auth/session state and message data being used for sends, history, media, and channel replies. Prefer pinning or independently verifying the wacli CLI version, configure allowFrom and group policies tightly, and leave optional voice-call support disabled unless needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Third-Party CLI Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:11-25 (duplicated in skills/wacli/SKILL.md:11-25)
Vulnerability Type: Unpinned external dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

yaml

"install":
  [
    {
      "id": "brew",
      "kind": "brew",
      "formula": "steipete/tap/wacli",
      "bins": ["wacli"],
      "label": "Install wacli (brew)",
    },
    {
      "id": "go",
      "kind": "go",
      "module": "github.com/steipete/wacli/cmd/wacli@latest",
      "bins": ["wacli"],
      "label": "Install wacli (go)",
    },
  ],

Technical Analysis

The skill permits installation of wacli from a third-party Homebrew tap and from a mutable Go module reference ending in @latest. Neither installation method identifies an immutable, audited source revision or package checksum.

In particular, @latest resolves at installation time. The effective program installed on a user's system may therefore differ from the version that existed when this skill was reviewed. The Homebrew formula is similarly controlled through an external tap without an explicit version or integrity constraint in the skill metadata.

This is a supply-chain weakness rather than evidence that the currently referenced project is malicious. However, it unnecessarily expands trust to future upstream releases and repository state. Since wacli is intended to authenticate to WhatsApp, synchronize message history, search messages, and send files or messages, compromise of the installed executable could expose highly sensitive account and conversation data.

The package's npm dependencies are separately pinned in npm-shrinkwrap.json with integrity hashes. The pre-scan warning concerning network transmission in that file was not substantiated as credential exfiltration: its URLs are package registry or funding metadata. The confirmed issue is limited to the mutable external CLI insta ...[truncated 1495 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an explicitly reviewed semantic version or, preferably, an immutable commit:

   yaml

   "module": "github.com/steipete/wacli/cmd/wacli@vX.Y.Z"
   

2. Pin the Homebrew installation to a controlled and versioned formula where supported.
3. Record and verify cryptographic checksums or signatures for distributed artifacts before execution.
4. Document the reviewed upstream version and update it only through a deliberate dependency-review process.
5. Prefer an official, controlled distribution channel over a third-party tap when one is available.
6. Run the CLI with only the filesystem and network permissions required for WhatsApp operations, and isolate its credential store from unrelated user data.
7. Apply the same changes to both SKILL.md and skills/wacli/SKILL.md to prevent the duplicated metadata from restoring the unsafe installation path.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (74)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The declared description focuses on two capabilities: sending third-party WhatsApp messages and syncing/searching WhatsApp history via wacli, specifically not normal active chats. This code chunk does not implement history sync/search at all, and it does not provide general-purpose message sending. Its core purpose is inbound message admission and access control: resolving account/group policy, checking sender authorization, handling self-chat/same-phone logic, blocking or allowing messages, constructing admission records, and issuing pairing challenges for unauthorized DMs. It does send a WhatsApp message in one narrow case, but only as an automated pairing reply, which is a supporting detail of access control rather than the declared primary purpose. Therefore the description materially misrepresents the actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says the skill sends third-party WhatsApp messages or syncs/searches WhatsApp history through wacli. However, the provided code implements only reaction handling for WhatsApp messages. It reads an action parameter, supports only the "react" action, checks reaction-level settings, authorizes the target chat against an allowlist, and calls sendReactionWhatsApp to add or remove a reaction on a message. There is no code for sending messages, syncing history, or searching history. This is a material description-behavior mismatch because the actual primary capability in this chunk is message reaction management, which is undeclared, while the declared capabilities are absent from the implementation shown.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description explicitly says the skill is for third-party messaging or syncing/searching WhatsApp history via wacli, and 'not normal active chats.' However, the code directly retrieves an active listener from a WhatsApp connection controller, indicating active/live chat connection behavior. That is materially inconsistent with the stated exclusion of normal active chats, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says the skill is for sending third-party WhatsApp messages or syncing/searching WhatsApp history through wacli. The supplied code does none of those things. Instead, it implements a login utility named whatsapp_login that starts a WhatsApp web linking flow, produces a QR code image for scanning, optionally forces a new login, waits for scan completion, and returns whether the account is connected. This is a materially different primary purpose and introduces an undeclared capability: authentication/account linking.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description frames the skill as third-party WhatsApp messaging or syncing/searching WhatsApp history via wacli, explicitly 'not normal active chats.' However, the code chunk contains startWhatsAppQaDriverSession, which establishes a live WhatsApp socket session, subscribes to messages.upsert and connection.update events, normalizes inbound messages, stores observed messages, and provides waitForMessage for real-time chat observation. It also provides active send operations (sendText, sendMedia, sendPoll, sendReaction, sendSticker, sendContact, sendLocation) over that session. This is materially different from merely syncing/searching history and contradicts the 'not normal active chats' limitation, because it directly interacts with and monitors active chats in real time.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The declared description focuses on sending third-party WhatsApp messages or syncing/searching WhatsApp history through wacli, explicitly contrasting this with normal active chats. The code instead is specifically an approval-handler integration for WhatsApp: it prepares approval targets, sends pending approval messages, emits typing indicators, updates messages with resolved/expired text, and binds/unbinds reaction targets so users can interact with approvals. While sending WhatsApp messages is part of the implementation, the primary purpose is not generic third-party messaging or history sync/search; it is an interactive approval workflow over WhatsApp. That is a materially different behavior not captured by the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description centers on WhatsApp operational capabilities: sending third-party messages and syncing/searching WhatsApp history through wacli. The provided code instead implements approval workflow plumbing via resolveApprovalOverGateway, using approvalId, decision, senderId, and gatewayUrl. While it is named for WhatsApp and may support a WhatsApp-related approval flow, that is materially different from the declared end-user functionality. No code here performs message sending, history synchronization, or search, so the description does not accurately represent this code chunk's actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description centers on WhatsApp messaging and history synchronization/search through wacli. The provided code does not implement any visible WhatsApp send, sync, or search functionality. Instead, it wraps and exports a function named transcribeFirstAudio from a media runtime module, which is a materially different capability focused on audio transcription/preflight processing. That is an undeclared and unrelated primary behavior compared with the stated purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The provided code does not send WhatsApp messages, sync chat history, or search history. Its actual function is to locate candidate OAuth/WhatsApp account directories and determine whether stored web credentials exist. That is a materially different primary purpose from the declared description. While this may support a broader WhatsApp integration, the chunk itself is specifically about authentication presence detection and filesystem inspection, which is not represented in the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description focuses on sending third-party WhatsApp messages or syncing/searching WhatsApp history through wacli. This code chunk does not implement messaging, history sync, or history search. Its primary purpose is credential persistence and session management for WhatsApp Web authentication. It accesses local auth storage under OAuth/state directories, manages creds backups, determines whether a web session is linked, exposes the account identity from creds, and clears credentials on logout. Those are materially different capabilities from the declared purpose, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description says the skill sends third-party WhatsApp messages or syncs/searches WhatsApp history via wacli, and explicitly distinguishes itself from normal active chats. The code does something materially different: it defines a whatsapp_call tool that is only available in WhatsApp message context, resolves the current requester’s phone number, generates telephony audio from text, and invokes the meowcaller notify command to place a WhatsApp voice call to that requester. It also exposes a status action for MeowCaller setup. There is no implementation of third-party message sending, history synchronization, history search, or wacli usage. This is a clear description-behavior mismatch with a different primary purpose and undeclared calling capability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description is materially narrower than the code. The code does not show history sync/search via wacli as its primary behavior; instead it defines a comprehensive active WhatsApp channel integration built around WhatsApp Web/gateway runtime. It supports outbound chat messaging to direct chats, groups, and newsletters, plus media, polls, reactions, typing, quoting, approvals, login/logout, runtime monitoring, and account/directory features. That conflicts with the declared purpose of only sending third-party WhatsApp messages or syncing/searching history, 'not normal active chats.'

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description emphasizes sending third-party WhatsApp messages or syncing/searching WhatsApp history via wacli, and explicitly contrasts this with normal active chats. The supplied code does not implement history sync/search at all. Instead, it handles active WhatsApp channel actions: (1) reacting to messages with emoji/removal support, and (2) uploading/sending files or media with captions, voice/document options, and direct outbound targeting. These are materially different active-chat capabilities that are not represented in the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description focuses on messaging and history sync/search through wacli, and specifically says it is not for normal active chats. However, this code chunk does not implement message sending or history sync/search. Instead, its primary purpose is managing a WhatsApp Web connection/session, including login via QR, auth persistence/state access, logout, and channel monitoring. Those are materially different capabilities from the declared purpose, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 82% confidence

Finding

The declared purpose focuses on operational messaging/history capabilities through WhatsApp via wacli. This code chunk does not implement message sending, history sync, or search. Instead, it is infrastructure for channel setup and configuration, including auth-state validation and migration handling. That is a materially different primary purpose from the declared description, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose centers on operational WhatsApp actions through wacli: sending third-party messages and syncing/searching WhatsApp history, specifically excluding normal active chats. The supplied code does none of that. Instead, it builds a configuration schema for a WhatsApp channel, including settings for direct-message policy, self-chat mode, batching/debounce, config writes, mention patterns, and optional voice calls. These are materially different capabilities and suggest support for active WhatsApp chat/channel behavior, not historical sync/search or third-party messaging via wacli.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a WhatsApp integration skill with operational capabilities around messaging and history access. The actual code shown is only a constants module that imports and re-exports DEFAULT_WEB_MEDIA_BYTES. This behavior is materially different from the declared primary purpose, because the snippet contains no logic for wacli usage, no messaging, no history synchronization, and no search capabilities. While constants can be supporting details, this chunk by itself does not accurately represent the declared functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description focuses on operational WhatsApp actions through wacli: sending messages and syncing/searching message history. The supplied code does not implement messaging, history sync, search, or chat interaction. Instead, it provides filesystem utilities for locating, validating, and reading local WhatsApp credential files. That is a materially different purpose and introduces an undeclared capability involving local credential file access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied code does not send WhatsApp messages, sync history, or search WhatsApp history. Instead, it resolves merged WhatsApp account configuration and exposes functions to list directory peers and groups based on allowFrom and groups settings, including normalization/filtering of WhatsApp IDs. That is a materially different primary purpose from the declared description, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The declared description focuses on sending WhatsApp messages and syncing/searching WhatsApp history through wacli. The supplied code does not implement messaging, history sync, or search. Instead, it registers directory functions for listing peers and groups from config. That is a materially different primary capability, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared purpose focuses on operational WhatsApp capabilities through wacli: sending third-party messages and syncing/searching WhatsApp history. The supplied code instead implements a helper that rewrites configuration fields for WhatsApp reaction acknowledgments, specifically migrating legacy messages.ackReaction and messages.ackReactionScope into channels.whatsapp.ackReaction. This is a materially different primary purpose from the declared messaging/history features. Although it is WhatsApp-related, it does not implement the described user-facing functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description promises operational WhatsApp features through wacli: sending messages and syncing/searching history. The supplied code chunk does not implement any of those behaviors. Instead, it wraps and re-exports a normalizeCompatibilityConfig function and defines empty legacy config rules, which is a configuration/contract utility role. This is a materially different primary purpose from the declared description, so the description does not accurately represent the code shown.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description suggests user-facing capabilities around sending third-party WhatsApp messages and syncing/searching WhatsApp history via wacli. This code chunk does not implement sending, syncing, or searching history. Instead, it provides lower-level helper logic for quoted message metadata caching/lookup and group session key routing. Those behaviors are related to WhatsApp infrastructure, but they are materially different from the declared primary purpose and omit the advertised messaging/history operations. Therefore the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose centers on operational WhatsApp actions: sending third-party messages and syncing/searching WhatsApp history through wacli. The actual code chunk does not implement any such behavior. It merely re-exports two helper functions for working with legacy group session keys. That is a materially different primary purpose, and the claimed capabilities are absent from this code. Therefore the description does not accurately represent the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code chunk does not implement or expose functionality for sending WhatsApp messages, syncing history, or searching history via wacli. Instead, it re-exports a legacy state migration detection function, which is a different maintenance/internal capability. This is a materially different primary purpose from the declared description, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.