ClawHub
Back to skill

Security audit

farid wa

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its WhatsApp Business purpose, but it gives agents high-impact send/delete authority and includes unsafe examples for handling API keys and OAuth URLs.

Review before installing if this will be used with a real WhatsApp Business account. Use a narrowly scoped Maton key where possible, never print or paste the full API key, treat connection authorization URLs as secrets, and require explicit confirmation of recipients, phone-number IDs, template names, media IDs, and connection IDs before sending, updating, or deleting anything.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:601
Finding

API Key Disclosure Through Troubleshooting Output

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:91
Finding

OAuth Session URL Disclosure Through Unredacted Connection Responses

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
87% confidence
Finding

The documented DELETE media endpoint can permanently remove resources if an agent is induced to pass an attacker-chosen media_id or acts without confirmation. In an agent/tooling context, destructive parameterized endpoints increase the risk of unauthorized deletion or operational disruption.

Content

Scanner excerpt · SKILL.md (reported line 398)May include surrounding context.

Delete Media

bash
DELETE /whatsapp-business/v21.0/{media_id}

Message Templates

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
89% confidence
Finding

The delete-template endpoint allows destructive action based on a user-supplied template name and account identifier, creating risk of accidental or manipulated deletion of messaging templates. In production workflows, this could break customer communications or compliance-approved messaging flows.

Content

Scanner excerpt · SKILL.md (reported line 446)May include surrounding context.

Delete Template

bash
DELETE /whatsapp-business/v21.0/{whatsapp_business_account_id}/message_templates?name=template_name

Phone Numbers

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill prominently documents actions that send messages, upload media, and modify external WhatsApp resources, but it does not include clear user-consent or impact warnings near those examples. In an agent setting, this increases the risk of unintended external communications or destructive actions being performed on behalf of a user without adequate notice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The delete examples for connections and media are operationally destructive, yet the documentation does not warn that they may revoke access, disrupt automations, or permanently remove resources. In agent-driven use, omission of such warnings can cause accidental service interruption or data loss.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 499)May include surrounding context.

md
};

// Send text message
await fetch(
  'https://gateway.maton.ai/whatsapp-business/v21.0/PHONE_NUMBER_ID/messages',
  {
    method: 'POST',

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 514)May include surrounding context.

md
};

// Send text message
await fetch(
  'https://gateway.maton.ai/whatsapp-business/v21.0/PHONE_NUMBER_ID/messages',
  {
    method: 'POST',

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 544)May include surrounding context.

md
}

# Send text message
response = requests.post(
    'https://gateway.maton.ai/whatsapp-business/v21.0/PHONE_NUMBER_ID/messages',
    headers=headers,
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 556)May include surrounding context.

md
}

# Send text message
response = requests.post(
    'https://gateway.maton.ai/whatsapp-business/v21.0/PHONE_NUMBER_ID/messages',
    headers=headers,
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 544)May include surrounding context.

md
}

# Send text message
response = requests.post(
    'https://gateway.maton.ai/whatsapp-business/v21.0/PHONE_NUMBER_ID/messages',
    headers=headers,
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 556)May include surrounding context.

md
}

# Send text message
response = requests.post(
    'https://gateway.maton.ai/whatsapp-business/v21.0/PHONE_NUMBER_ID/messages',
    headers=headers,
    json={

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

Telling users to echo the API key directly can expose the credential on shared terminals, screen recordings, logs, or shell history, increasing the chance of credential theft. Although it is framed as troubleshooting, it normalizes unsafe secret handling.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_resource_identifier

Example code exposes a concrete connection_id instead of a placeholder.

Critical
Code
suspicious.exposed_resource_identifier
Location
SKILL.md:105