ClawHub
Back to skill

Security audit

Wacli Gilles

Security checks for vulnerabilities and agentic risk

Overview

The skill is clearly for WhatsApp automation, but it installs and runs a mutable external CLI that can access WhatsApp login state, message history, and send messages.

Review this before installing if your WhatsApp account contains sensitive personal or business messages. Prefer a pinned, reviewed wacli version if available, confirm every outbound message, and avoid leaving continuous sync running unless you intentionally want local WhatsApp history available to the CLI.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:20
Finding

Unpinned Go Dependency Allows Supply-Chain Substitution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–25
Vulnerability Type: Unpinned executable dependency from a mutable upstream reference
Risk Level: Medium

Vulnerable Code

json
{
  "id": "go",
  "kind": "go",
  "module": "github.com/steipete/wacli/cmd/wacli@latest",
  "bins": ["wacli"],
  "label": "Install wacli (go)"
}

Technical Analysis

The Go installation specification uses the mutable @latest reference rather than an audited release version or immutable commit. The binary installed in the future can therefore differ from the implementation that was reviewed when this skill was published.

If the upstream repository, maintainer account, release process, or dependency chain is compromised, go install may build and install attacker-controlled executable code. The skill subsequently directs users or agents to invoke that binary for WhatsApp authentication, message-history synchronization, searches, and message or file transmission.

No malicious behavior in the current upstream package is established by the reviewed file. The vulnerability is the absence of dependency immutability and provenance controls.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, its release pipeline, or a relevant dependency.
  2. The attacker publishes a malicious version that becomes the version resolved by github.com/steipete/wacli/cmd/wacli@latest.
  3. A user installs the skill dependency through the documented Go installation method.
  4. Go retrieves, builds, and installs the substituted code as the wacli executable.
  5. The user or agent invokes wacli for authentication, synchronization, history access, or messaging.
  6. The malicious binary executes with the installing user's privileges and may access data available to that process.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the user who installs or runs wacli. Within those privil ...[truncated 590 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with a specific, audited semantic version, for example:
    json
    "module": "github.com/steipete/wacli/cmd/wacli@vX.Y.Z"
  2. For stronger immutability, pin an explicitly reviewed commit where the installation framework supports it.
  3. Establish a controlled update process that reviews source changes and security advisories before changing the pinned version.
  4. Verify release provenance, signatures, and checksums where supported by the upstream release process.
  5. Use automated dependency monitoring to identify security updates without automatically installing unaudited releases.
  6. Document the expected package owner and canonical repository so maintainers can detect repository substitution or ownership changes.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.