PROBAR

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:04 PM UTC
• Version: 1.0.0

Overview

The skill clearly exposes a WhatsApp CLI for user-directed sending and history search, with disclosed auth/storage behavior and no hidden execution in the package.

Install only if you trust the wacli upstream package and are comfortable granting it access to WhatsApp authentication state and message history. Prefer a pinned or reviewed wacli release where possible, and review confirmations carefully before sending messages or files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned Third-Party CLI Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code Snippet

yaml

metadata: {"clawdbot":{"emoji":"📱","requires":{"bins":["wacli"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/wacli","bins":["wacli"],"label":"Install wacli (brew)"},{"id":"go","kind":"go","module":"github.com/steipete/wacli/cmd/wacli@latest","bins":["wacli"],"label":"Install wacli (go)"}]}}

Technical Analysis

The Go installation source explicitly uses the mutable version selector @latest. The Homebrew installation references the third-party tap steipete/tap/wacli without pinning an audited release or specifying an integrity checksum.

Consequently, the executable installed in the future may differ from the version reviewed when this skill was published. An upstream repository, release process, maintainer account, Go module, or Homebrew tap compromise could cause users to install a modified executable without any corresponding change to the skill package.

This is especially sensitive because the installed wacli executable is expected to authenticate to WhatsApp, synchronize and search private message history, read files selected for transmission, and store authentication state under ~/.wacli.

Attack Path

1. An attacker compromises the upstream source repository, release pipeline, maintainer credentials, Go module distribution path, or custom Homebrew tap.
2. The attacker publishes a malicious release that becomes the version selected by @latest, or changes the formula to install a malicious artifact.
3. A user installs or reinstalls wacli through the installation metadata in this skill.
4. The mutable dependency resolves to the attacker-controlled executable.
5. The executable runs with the invoking user's operating-system privileges.
6. During authentication, synchronization, history searches, or message sending, the malici ...[truncated 1037 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace github.com/steipete/wacli/cmd/wacli@latest with a specifically audited semantic version or immutable commit identifier.
2. Pin the Homebrew installation to a reviewed release rather than relying solely on the current state of a mutable third-party tap.
3. Verify downloaded artifacts using publisher signatures or cryptographic checksums stored in a trusted, independently controlled location.
4. Document the expected publisher, repository, release version, and artifact digest so users can validate provenance before installation.
5. Use automated dependency monitoring to identify security advisories and intentionally review upgrades instead of automatically selecting the newest release.
6. Run the CLI with least privilege and restrict access to ~/.wacli using appropriate filesystem permissions.
7. Revoke WhatsApp sessions and rotate affected authentication state if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.