EngageLab WhatsApp Business

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:25 PM UTC
• Version: 1.0.0

Overview

The skill is a real EngageLab WhatsApp API helper, but it handles high-impact messaging credentials and business resources with under-scoped safeguards.

Review before installing. Use only with scoped EngageLab credentials, do not override the API base URL except in a controlled test environment with non-production keys, confirm exact templates before deletion, and add independent webhook protections such as a shared-secret gateway, schema validation, replay checks, and rate limiting before trusting callbacks.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/whatsapp_client.py:47

Finding

Basic Authentication Credentials Can Be Disclosed to a Caller-Controlled API Origin

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/callback-api.md:15

Finding

Callback Integration Guidance Requires an Unauthenticated Webhook Endpoint

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code substantially matches the declared messaging and template-management capabilities: it authenticates, constructs requests, handles errors, sends all listed message types, and performs template CRUD/list/get operations against EngageLab WhatsApp endpoints. However, the description also claims callback webhook handling and callback configuration, which are not present in this code chunk. There are no webhook server routes, handlers, signature validation, callback registration methods, or related logic. Therefore the description overstates the implemented capabilities in a material way, producing a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The documented delete operation targets a template name and states that it deletes all languages for that name, which creates a high-risk destructive action from a potentially ambiguous user input. In an agent setting, this can lead to bulk deletion of multiple templates when the user may have intended to remove only one localized variant or review the target first.

Content

Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.

md

**Update** — `PUT /v1/templates/:templateId` (same body as create)

**Delete** — `DELETE /v1/templates/:templateName` (deletes all languages for that name)

### Template Categories

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

Using a destructive DELETE operation keyed only by templateName creates a parameter-abuse risk because a simple, human-guessable identifier can trigger deletion of multiple resources at once. In this skill, an LLM-driven agent may select or transform names incorrectly, causing overbroad or unauthorized destructive actions against WhatsApp business templates.

Content

Scanner excerpt · references/template-api.md (reported line 141)May include surrounding context.

md

## 5. Delete Template

`DELETE /v1/templates/:templateName`

Pass the **template name** (not ID) in the URL path. This deletes all language variants of that template.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents network-capable behavior against an external API but does not declare any explicit tool scope or allowed-tools constraints. In an agent environment, that omission weakens policy enforcement and can allow unintended outbound requests or broader tool access than users expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad enough to activate on generic 'WhatsApp' or 'WhatsApp API' requests, which can cause the wrong skill to be selected and prompt unnecessary use of external messaging functionality. Misrouting in this context is risky because the skill deals with credentials, recipient phone numbers, and outbound communications to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill lacks an explicit warning that recipient identifiers, message bodies, media links, and possibly template data will be transmitted to an external provider. Without that disclosure, users may unknowingly expose sensitive personal or business data to a third-party API and webhook flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation explicitly instructs users to expose a webhook endpoint that does not require authentication because the callback security mechanism is 'pending'. That creates a true vulnerability: any internet client could forge callback requests, inject fake delivery or reply events, trigger business logic, pollute audit trails, or abuse downstream automation that trusts webhook contents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation states that deleting by template name removes all language variants, but it does not prominently warn users about this broad destructive effect or require a safer confirmation pattern. In an agent skill context, this can lead to unintended bulk deletion if the agent or user assumes only a single localized template will be removed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The constructor accepts a developer key and secret, encodes them into a Basic Authorization header, and uses them for all outbound API calls. Although this is functionally expected for an API client, the file does not include any warning or disclosure about handling sensitive credentials or sending them to a remote service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code sends payloads containing recipient numbers, message bodies, and template data to an external WhatsApp API via HTTP requests. While the module docstring describes API usage, there is no runtime confirmation, logging, or explicit warning that user-provided data will be transmitted off-system.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.