TinkerClaw WhatsApp

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:18 AM UTC
• Version: 4.0.3

Overview

This skill is not clearly malicious, but it needs review because it can use a linked WhatsApp account to manage groups and export or store sensitive WhatsApp contact and message data.

Install only if you are comfortable giving this skill effective control over a linked WhatsApp account. Review helper scripts before running them, especially the contact export and history patch scripts, and avoid using them on accounts or groups where participants have not consented to contact, membership, or message-history data being exported or retained.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises broad operational capabilities that imply access to environment data and local files, yet it declares no permissions. This creates a transparency and least-privilege problem: operators may install it without understanding it can read or write workspace data or access configuration-bearing files, increasing the chance of unintended data exposure or tampering.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is a WhatsApp coordination protocol, but the behavior extends into patching OpenClaw source, storing inbound message history, exposing auth-profile metadata, creating groups with stored credentials, and exporting participant/contact data. That mismatch is dangerous because it hides privileged, privacy-impacting, and persistence-related behavior behind a comparatively narrow description, preventing informed consent and security review.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The script reads persistent WhatsApp authentication material from the user's home directory and uses it to perform account actions. Even if this is functionally required for Baileys, it grants the script access to a sensitive session outside the skill's stated scheduling-focused purpose, increasing the risk of unauthorized account operations if the script is run or repurposed. In this skill context, the mismatch between description and capability makes the credential access more concerning.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: This file creates WhatsApp groups, a capability not disclosed by the skill description, which describes congestion control and scheduling behavior rather than account-level messaging administration. Undisclosed capability expansion is dangerous because users may install or run the skill expecting orchestration logic, while it can perform real external actions affecting contacts and account state. The context makes this more dangerous because group creation is a materially different and privacy-impacting operation.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The script enumerates all WhatsApp groups, derives participant identities, and persists a comprehensive contact/group-membership dataset to disk. That collection materially exceeds the stated scheduling and congestion-control purpose of the skill, creating an unnecessary surveillance-style data export that can expose sensitive social graph information if misused or compromised.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code loads reverse LID mappings from the auth directory and resolves opaque WhatsApp identifiers into real phone numbers, directly increasing identifiability of users. This turns otherwise less-readable participant data into a persistent directory of real-world contacts, which is especially dangerous because it is unrelated to the declared agent scheduling function.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The skill documents destructive and privacy-sensitive actions such as unsend/delete, participant management, invite-link handling, full-text search, and extraction of contact phone numbers, but provides no prominent safety warnings, authorization requirements, or consent guidance. In a messaging skill with direct access to personal chats and groups, omission of these cautions raises the risk of misuse, privacy violations, and accidental destructive actions.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script accesses WhatsApp session credentials from a default path in the user's home directory without an explicit warning or consent prompt at runtime. This is risky because users may not realize the script will leverage an already authenticated account session, enabling account actions under their identity. Given the skill's stated purpose, this silent credential use is less expected and therefore more sensitive.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script transmits participant phone numbers to WhatsApp to create a group without explicitly warning the operator that personal data will be sent to a third party. This can create privacy and compliance issues, especially if numbers are supplied for people who have not consented to being grouped. In this skill context, the network action is not obviously implied by the advertised scheduling features, which increases the surprise and risk.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script writes a sensitive export containing phone numbers, group memberships, admin status, and self ID to a predictable file path without any explicit warning, confirmation, or sensitivity notice. This increases the chance that operators unknowingly create a high-value local data dump that may later be accessed by other users, tools, or malware on the host.

Missing User Warnings

Medium

• Confidence: 71% confidence
• Finding: The script reads WhatsApp authentication state from a local credentials directory to impersonate or access an existing session, but provides no disclosure that it is handling highly sensitive credential material. In security terms, this is risky because users may run the script without understanding it is consuming session secrets that enable broad account access.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The script’s stated purpose is to patch the application so all inbound WhatsApp messages are stored in a history database, including self-chat messages that were previously missed. That broad retention materially increases collection of message content and associated personal data, creating privacy, compliance, and breach-impact risks if users did not explicitly consent to such storage or if retention is not minimized and protected.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The patch block captures every inbound message plus metadata such as chat ID, sender ID, contact name, push name, timestamps, and message text, then inserts it into a history database. In a messaging context this is especially sensitive because it aggregates personal communications and identifiers, increasing the harm from misuse, insider access, over-retention, or database compromise.

Session Persistence

Medium

• Category: Rogue Agent

Content

fs.writeFileSync(OUTPUT_PATH, JSON.stringify(output, null, 2));
    
    console.log(`\n📱 Extracted ${resolved.length} contacts from ${groupList.length} groups`);
    if (unresolved.length > 0) {
      console.log(`⚠️  ${unresolved.length} contacts have unresolved LIDs`);
    }

• Confidence: 88% confidence
• Finding: pList

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.