PROBAR
v1.0.0Send WhatsApp messages to other people or search/sync WhatsApp history via the wacli CLI (not for normal user chats).
⭐ 0· 775·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md and requirements align: the skill is a wrapper around the wacli CLI to send messages and search/sync WhatsApp history and correctly requires the wacli binary. However, registry-level metadata (skill name/owner) does not fully match the included _meta.json and SKILL.md which reference 'wacli' while the registry lists 'PROBAR'/'probar' and a different ownerId — this mismatch is an inconsistency that should be clarified.
Instruction Scope
Runtime instructions are narrowly scoped to calling wacli commands (auth, sync, search, send, backfill). They do not instruct the agent to read unrelated system files or arbitrary environment variables. The SKILL.md explicitly requires explicit recipient/message confirmation and notes the store directory (~/.wacli) and file-sending behavior, which is appropriate for the stated purpose.
Install Mechanism
Install options are standard: a Homebrew formula (steipete/tap/wacli) and a Go module (github.com/steipete/wacli). Both are traceable sources rather than arbitrary downloads. As a precaution, verify the brew tap and GitHub repo are the official project and review release contents before installing.
Credentials
The skill declares no required environment variables or external credentials, which is proportional. It will use the wacli store directory (~/.wacli) and may access files when sending attachments — that is expected for a WhatsApp CLI, but it implies access to local chat history and any files the agent is instructed to send.
Persistence & Privilege
The skill is not marked always:true and is user-invocable (normal). The SKILL.md references long-running operations (e.g., `wacli sync --follow`) which, if used, would give the CLI continued access to WhatsApp history while running. This is within the declared scope but increases runtime access to private data; consider whether the agent should be allowed to start long-running syncs autonomously.
What to consider before installing
This skill is a thin wrapper around the wacli CLI and its commands match the description, but take these precautions before installing: 1) Confirm the brew tap / GitHub repo (steipete/wacli) are legitimate and review their code/releases. 2) Ask the publisher to explain the metadata mismatch (registry ownerId/slug vs. _meta.json) — mismatched metadata could be an honest packaging error but should be explained. 3) Be aware the skill can authenticate via QR and sync/backfill WhatsApp history into ~/.wacli — that exposes private messages and attachments to the local environment. 4) If you are concerned about the agent sending messages without clear user intent, restrict autonomous invocation or require explicit confirmation before any send/sync action. 5) If you will use file-sending, ensure the agent only has access to intended files. If these checks raise questions or you cannot verify the upstream project/owner, consider not installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97d9djf9hkd0msp7vh2kxz9n580xz1aproyectovk97d9djf9hkd0msp7vh2kxz9n580xz1a
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📱 Clawdis
Binswacli
Install
Install wacli (brew)
Bins: wacli
brew install steipete/tap/wacliInstall wacli (go)
Bins: wacli
go install github.com/steipete/wacli/cmd/wacli@latest