test

Send WhatsApp messages to other people or search/sync WhatsApp history via the wacli CLI (not for normal user chats).

Security Scan

The skill is internally coherent: it declares and uses the wacli CLI to send/search WhatsApp messages and only requests the binaries/install mechanisms needed for that purpose.

Purpose & Capability

The description, required binary (wacli), and install specs (brew formula and Go module) align with the stated purpose of sending/searching WhatsApp messages. Minor metadata inconsistencies exist: the registry metadata (owner/slug) differs from the _meta.json/skill metadata (ownerId/slug 'wacli'), which is suspicious from a provenance/integrity standpoint but does not change the tool's declared capabilities.

Instruction Scope

SKILL.md instructs the agent to run wacli commands only for auth, sync, searching history, and sending messages/files. It references expected local paths (store dir ~/.wacli and arbitrary file paths when sending files) which is consistent with a CLI that stores session data and can upload local files. Note: access to ~/.wacli and arbitrary local file paths is necessary for this tool but is a privacy-sensitive capability (message history and local files).

Install Mechanism

Install options are standard: a Homebrew formula (steipete/tap/wacli) and a Go module (github.com/steipete/wacli/cmd/wacli@latest). These are expected for distributing a CLI. The Go 'latest' install pulls current upstream code at install time (moderate risk if you don't audit the repo); brew from a third-party tap is also reasonable but should be verified.

Credentials

No environment variables, extra credentials, or unrelated config paths are requested. The skill does not ask for unrelated secrets or wide-ranging environment access in its manifest.

Persistence & Privilege

always is false and the skill is instruction-only (no bundled code). It does not request persistent or elevated platform privileges or attempt to modify other skills' configs. It will naturally read/write the CLI's store directory (~/.wacli) as part of normal operation.

Assessment

This skill appears to do what it says: it invokes the wacli CLI to authenticate, sync, search history, and send messages/files. Before installing or using it: - Verify the wacli project and Homebrew tap (steipete) are the official sources you expect (review the GitHub repo and tap) because 'go @latest' and third-party brew taps pull upstream code at install time. - Understand privacy implications: using this skill will access your WhatsApp session directory (~/.wacli), allow searching message history, and can upload local files specified by the agent. Only use it when the user explicitly requests messaging a third party. - Be cautious about automatic use: the SKILL.md sensibly requires explicit recipient and message confirmation; ensure the agent follows those safeguards before sending anything. - Note the metadata mismatch (registry owner/slug vs _meta.json). That suggests the package metadata/packaging may be inconsistent—if provenance matters to you, confirm the publisher before trusting it with your WhatsApp account.

wacli

Use wacli only when the user explicitly asks you to message someone else on WhatsApp or when they ask to sync/search WhatsApp history. Do NOT use wacli for normal user chats; Clawdbot routes WhatsApp conversations automatically. If the user is chatting with you on WhatsApp, you should not reach for this tool unless they ask you to contact a third party.

Safety

• Require explicit recipient + message text.
• Confirm recipient + message before sending.
• If anything is ambiguous, ask a clarifying question.

Auth + sync

• wacli auth (QR login + initial sync)
• wacli sync --follow (continuous sync)
• wacli doctor

Find chats + messages

• wacli chats list --limit 20 --query "name or number"
• wacli messages search "query" --limit 20 --chat <jid>
• wacli messages search "invoice" --after 2025-01-01 --before 2025-12-31

History backfill

• wacli history backfill --chat <jid> --requests 2 --count 50

Send

• Text: wacli send text --to "[phone]" --message "Hello! Are you free at 3pm?"
• Group: wacli send text --to "[e-mail]" --message "Running 5 min late."
• File: wacli send file --to "[phone]" --file /path/agenda.pdf --caption "Agenda"

Notes

• Store dir: ~/.wacli (override with --store).
• Use --json for machine-readable output when parsing.
• Backfill requires your phone online; results are best-effort.
• WhatsApp CLI is not needed for routine user chats; it’s for messaging other people.
• JIDs: direct chats look like <number>@s.whatsapp.net; groups look like <id>@g.us (use wacli chats list to find).