ClawHub
Back to skill

Security audit

Evolution Api v2

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent WhatsApp automation reference skill, but it documents broad account-control and data-forwarding workflows with under-scoped safety guidance.

Install only if you understand that this skill can guide an agent to administer a live WhatsApp automation server. Use least-privilege instance keys, avoid public webhook collectors for real data, prefer HTTPS endpoints, narrow webhook events and chatbot triggers, confirm consent before broadcasts/imports, and require explicit confirmation before delete/logout/group/profile operations.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:926
Finding

Broad WhatsApp Event Export to a Public Third-Party Webhook

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 926–971
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Code

bash
# Set Webhook
POST /webhook/set/{instance}

{
  "webhook": {
    "enabled": true,
    "url": "https://webhook.site/your-id",
    "headers": {
      "autorization": "Bearer TOKEN",
      "Content-Type": "application/json"
    },
    "byEvents": false,
    "base64": false,
    "events": [
      "APPLICATION_STARTUP",
      "QRCODE_UPDATED",
      "MESSAGES_UPSERT",
      "MESSAGES_UPDATE",
      "MESSAGES_DELETE",
      "SEND_MESSAGE",
      "CONTACTS_UPDATE",
      "PRESENCE_UPDATE",
      "CHATS_UPDATE",
      "CHATS_DELETE",
      "GROUPS_UPSERT",
      "GROUP_UPDATE",
      "GROUP_PARTICIPANTS_UPDATE",
      "CONNECTION_UPDATE",
      "LABELS_EDIT",
      "LABELS_ASSOCIATION",
      "CALL",
      "TYPEBOT_START",
      "TYPEBOT_CHANGE_STATUS"
    ]
  }
}

# Find Webhook
GET /webhook/find/{instance}

The document also states:

text
- `byEvents` - If `true`, sends to separate URLs per event type
- `base64` - If `true`, media comes as base64 in payload

Technical Analysis

The Skill recommends https://webhook.site/your-id, a public third-party webhook inspection service, while enabling a broad collection of WhatsApp events. These events can contain message content, contact details, chat metadata, call information, group membership, connection state, labels, and QR-code updates. If base64 is enabled, received media can also be included directly in webhook payloads.

Network transmission is necessary for the declared webhook integration functionality and is not covert exfiltration. However, sending real WhatsApp data to a public testing service is not the minimum privilege necessary to demonstrate webhook functionality. The example lacks warnings about using synthet ...[truncated 1846 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the public testing-service example with an operator-controlled placeholder, such as https://webhook.internal.example/evolution.
  2. Add an explicit warning that public webhook collectors must only receive synthetic test data and must never be used with live conversations, contacts, QR codes, or media.
  3. Use a minimal event list by default, such as only CONNECTION_UPDATE, and require users to opt in to each additional event.
  4. Exclude QRCODE_UPDATED, MESSAGES_UPSERT, contact events, chat events, and media payloads unless they are essential to the workflow.
  5. Keep base64 disabled by default and explain that enabling it exports complete media content.
  6. Require HTTPS with certificate validation and recommend destination allowlisting.
  7. Authenticate webhook requests with a strong secret and use cryptographic request signatures where supported.
  8. Redact unnecessary message fields, phone numbers, credentials, tokens, and metadata before forwarding.
  9. Apply retention limits, access controls, audit logging, and deletion policies at the webhook receiver.
  10. Document consent, privacy, and regulatory obligations before exporting third-party communications.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:1221
Finding

Plaintext HTTP Permitted for Credential-Bearing Chatbot Integrations

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 1221–1272
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code

bash
#### Dify
POST /dify/create/{instance}

{
  "enabled": true,
  "botType": "chatBot",
  "apiUrl": "http://dify.site.com/v1",
  "apiKey": "app-123456",
  // Trigger options...
}

GET  /dify/find/{instance}
GET  /dify/fetch/{difyId}/{instance}
PUT  /dify/update/{difyId}/{instance}
DELETE /dify/delete/{difyId}/{instance}

POST /dify/changeStatus/{instance}
GET  /dify/fetchSessions/{difyId}/{instance}

POST /dify/settings/{instance}
GET  /dify/fetchSettings/{instance}

The same insecure URL pattern is repeated for other integrations:

json
{
  "enabled": true,
  "apiUrl": "http://flowise.site.com/v1",
  "apiKey": "app-123456"
}
json
{
  "enabled": true,
  "apiUrl": "http://n8n.site.com/v1",
  "apiKey": "app-123456"
}

Technical Analysis

The documented chatbot configurations use remote-looking http:// URLs together with API keys. When the Evolution API connects to these integrations over plaintext HTTP, API credentials and chatbot traffic lack transport confidentiality and server authentication.

An on-path attacker can observe requests, capture API keys, inspect WhatsApp-derived conversation content sent to the chatbot, or alter responses in transit. Because no authenticated encryption is provided by HTTP, application-level API keys do not mitigate interception or tampering.

Plaintext HTTP may be acceptable for a loopback endpoint or an isolated connection protected by another authenticated tunnel. The examples, however, use domain-style remote hosts and do not state that HTTP must be limited to such protected local environments.

Attack Path

  1. An operator copies one of the Dify, Flowise, N8N, Evolution Bot, or Evo AI examples.
  2. The operator configures a remot ...[truncated 1530 chars]
Remediation
View remediation

Remediation Suggestions

  1. Change every non-local integration example from http:// to https://.
  2. State that plaintext HTTP is permitted only for loopback addresses or isolated endpoints protected by an authenticated encrypted tunnel.
  3. Reject remote http:// endpoints during configuration validation.
  4. Require normal TLS certificate and hostname validation; do not recommend disabling certificate checks.
  5. Use narrowly scoped, integration-specific API keys instead of shared administrative credentials.
  6. Store credentials in a secret manager or protected environment variables rather than hardcoding them in configuration files or commands.
  7. Rotate keys after suspected exposure and provide documented revocation procedures.
  8. Minimize the WhatsApp content sent to chatbot providers and redact sensitive fields before transmission.
  9. Apply outbound hostname allowlists to prevent configuration from directing sensitive data to arbitrary destinations.
  10. Consider mutual TLS or signed application-layer requests for high-sensitivity deployments.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (22)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.

Logout Instance

bash
DELETE /instance/logout/{instance}
Header: apikey: $EVO_API_KEY

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.

Delete Instance

bash
DELETE /instance/delete/{instance}
Header: apikey: $EVO_GLOBAL_KEY

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 570)May include surrounding context.

Delete Message

bash
DELETE /chat/deleteMessageForEveryone/{instance}

{
  "id": "MESSAGE_ID",

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 768)May include surrounding context.

Remove Profile Picture

bash
DELETE /chat/removeProfilePicture/{instance}

Fetch Privacy Settings

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 919)May include surrounding context.

Leave Group

bash
DELETE /group/leaveGroup/{instance}?groupJid={groupJid}

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 1126)May include surrounding context.

md
GET  /typebot/find/{instance}
GET  /typebot/fetch/{typebotId}/{instance}
PUT  /typebot/update/{typebotId}/{instance}
DELETE /typebot/delete/{typebotId}/{instance}

# Start Typebot manually
POST /typebot/start/{instance}

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 1175)May include surrounding context.

md
{ "name": "apikey", "apiKey": "sk-proj-..." }

GET /openai/creds/{instance}
DELETE /openai/creds/{openaiCredsId}/{instance}

# Create Bot (Assistant or Chat Completion)
POST /openai/create/{instance}

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 1203)May include surrounding context.

md
GET  /openai/find/{instance}
GET  /openai/fetch/{openaiBotId}/{instance}
PUT  /openai/update/{openaiBotId}/{instance}
DELETE /openai/delete/{openaiBotId}/{instance}

# Session management
POST /openai/changeStatus/{instance}

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 1231)May include surrounding context.

md
GET  /dify/find/{instance}
GET  /dify/fetch/{difyId}/{instance}
PUT  /dify/update/{difyId}/{instance}
DELETE /dify/delete/{difyId}/{instance}

POST /dify/changeStatus/{instance}
GET  /dify/fetchSessions/{difyId}/{instance}

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 1256)May include surrounding context.

md
GET  /flowise/find/{instance}
GET  /flowise/fetch/{flowiseId}/{instance}
PUT  /flowise/update/{flowiseId}/{instance}
DELETE /flowise/delete/{flowiseId}/{instance}

POST /flowise/changeStatus/{instance}
GET  /flowise/fetchSessions/{flowiseId}/{instance}

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 1279)May include surrounding context.

md
GET  /n8n/find/{instance}
GET  /n8n/fetch/{n8nId}/{instance}
PUT  /n8n/update/{n8nId}/{instance}
DELETE /n8n/delete/{n8nId}/{instance}

POST /n8n/changeStatus/{instance}
GET  /n8n/fetchSessions/{n8nId}/{instance}

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 1302)May include surrounding context.

md
GET  /evolutionBot/find/{instance}
GET  /evolutionBot/fetch/{evolutionBotId}/{instance}
PUT  /evolutionBot/update/{evolutionBotId}/{instance}
DELETE /evolutionBot/delete/{evolutionBotId}/{instance}

POST /evolutionBot/changeStatus/{instance}
GET  /evolutionBot/fetchSessions/{evolutionBotId}/{instance}

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 1325)May include surrounding context.

md
GET  /evoai/find/{instance}
GET  /evoai/fetch/{evoaiId}/{instance}
PUT  /evoai/update/{evoaiId}/{instance}
DELETE /evoai/delete/{evoaiId}/{instance}

POST /evoai/changeStatus/{instance}
GET  /evoai/fetchSessions/{evoaiId}/{instance}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

bash
# Create instance (supports Baileys, Business, or Evolution integration)
curl -X POST "$EVO_API_URL/instance/create" \
  -H "apikey: $EVO_GLOBAL_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill describes inline webhook, RabbitMQ, SQS, and Chatwoot integrations that transmit message and contact data to third-party systems, but it does not clearly warn about privacy, data-sharing, retention, or sensitivity of WhatsApp content. In this context, external transmission is central to the feature set, so missing warnings materially increases the risk of operators exposing personal communications unintentionally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation lists logout and delete instance operations without emphasizing that they are destructive and may irreversibly disconnect automation or remove service state. In an admin-oriented messaging platform, omission of such warnings can lead to accidental service disruption or data loss through routine use or confused delegation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly documents triggerType: "all" as a valid chatbot mode, meaning a bot may process every incoming message without narrow scoping. In a WhatsApp automation context, this can cause unintended collection, forwarding, or automated responses across all conversations, especially when paired with external integrations and no guardrails.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1294)May include surrounding context.

md
{
  "enabled": true,
  "apiUrl": "http://api.site.com/v1",
  "apiKey": "app-123456",
  // Trigger options...
}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The broadcast workflow demonstrates mass messaging to multiple numbers without any warning about consent, spam, legal compliance, or account enforcement risk. Given this skill's WhatsApp automation purpose, such an example can directly enable unsolicited outreach and large-scale misuse.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1470)May include surrounding context.

Broadcast Message

bash
for number in 5511999999999 5511888888888 5511777777777; do
  curl -X POST "$EVO_API_URL/message/sendText/$EVO_INSTANCE" \
    -H "apikey: $EVO_API_KEY" \
    -H "Content-Type: application/json" \
    -d "{

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The example workflow configures Typebot with triggerType: "all" and presents it as a normal setup pattern without caution. Because this skill automates live WhatsApp accounts, that example encourages indiscriminate activation on every message, increasing the chance of unintended replies, data processing, and abuse at scale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The WhatsApp Business template examples specify language: "en_US" as the default locale, but the documentation does not indicate that locale should be chosen based on user preference or deployment region. This can be read as prescribing a specific language/locale without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.