Whop

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:27 AM UTC
• Version: 1.0.1

Overview

This Whop skill is a disclosed business and developer workflow guide that uses Whop APIs, optional local notes, and optional tooling in ways that fit its stated purpose.

Install only if you are comfortable letting an agent keep non-secret Whop business notes in ~/whop/ and, when you choose advanced workflows, send Whop business, customer, payment, webhook, and growth data to Whop APIs. Keep API keys and webhook secrets in environment variables, use sandbox before payment or webhook changes, clearly disclose auto-converting trials to customers, and pin/review the optional dev proxy dependency before installing it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: proxy-and-local-dev.md:11

Finding

Unpinned Executable Development Dependency

Content

View full analysis

Vulnerability Details

File Location: proxy-and-local-dev.md, lines 11-17
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code

markdown

Whop documents the proxy package as `@whop-apps/dev-proxy`.

```bash
pnpm add -D @whop-apps/dev-proxy
npm install --save-dev @whop-apps/dev-proxy
yarn add -D @whop-apps/dev-proxy
bun add -d @whop-apps/dev-proxy

text

### Technical Analysis

The documented commands install `@whop-apps/dev-proxy` without an exact version or explicit integrity constraint. Each package manager can therefore resolve a package release that differs from the release available when the Skill was audited.

Third-party package installation is an executable supply-chain boundary. Package managers may run lifecycle scripts during installation, and the installed CLI is later executed as `whop-proxy`. If the publisher account, registry package, or release process were compromised, a malicious future release could execute code in the developer environment. Describing the package as official does not eliminate this mutable dependency risk.

No evidence indicates that the package is currently malicious; the vulnerability is the unsafe, non-reproducible installation guidance.

### Attack Path

1. An attacker compromises the package publisher account, registry entry, or release pipeline for `@whop-apps/dev-proxy`.
2. The attacker publishes a malicious version that becomes the default version resolved by package managers.
3. A user follows one of the documented installation commands.
4. The package manager downloads the compromised release and may execute malicious lifecycle scripts during installation.
5. The user subsequently runs `whop-proxy`, providing another opportunity for the compromised package to execute.
6. The malicious code runs with the privileges of the developer account and can access resources available to that account.

### Impact Assessment

Successful exploitation could prov
...[truncated 592 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unversioned package reference with an exact, reviewed version in every supported command, for example:

   bash

   npm install --save-dev --save-exact @whop-apps/dev-proxy@REVIEWED_VERSION
   

2. Commit the relevant lockfile and require reproducible installation in automation:

   • npm ci
   • pnpm install --frozen-lockfile
   • yarn install --immutable
   • bun install --frozen-lockfile

3. Verify package provenance, publisher identity, registry source, and integrity metadata before approving version updates.

4. Review dependency changes and lifecycle scripts whenever the pinned version is upgraded.

5. Consider performing the initial dependency review with lifecycle scripts disabled, where operationally practical, before permitting package scripts to execute.

6. Configure the package manager to use the expected trusted registry and prevent unintended registry substitution or dependency-confusion paths.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (27)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

### 6. Treat advanced automation as a separate trust boundary
- Server-to-server work uses `Authorization: Bearer ...` against `https://api.whop.com/api/v1`.
- Embedded app requests inside a Whop iframe identify the current user through `x-whop-user-token`.
- Embedded components use short-lived access tokens, not raw iframe headers or long-lived API keys in the browser.
- Webhooks must be verified before side effects, and sandbox and production assets must stay fully separate.

### 7. Keep Whop IDs and environments explicit

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

### 6. Treat advanced automation as a separate trust boundary
- Server-to-server work uses `Authorization: Bearer ...` against `https://api.whop.com/api/v1`.
- Embedded app requests inside a Whop iframe identify the current user through `x-whop-user-token`.
- Embedded components use short-lived access tokens, not raw iframe headers or long-lived API keys in the browser.
- Webhooks must be verified before side effects, and sandbox and production assets must stay fully separate.

### 7. Keep Whop IDs and environments explicit

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md

### 6. Treat advanced automation as a separate trust boundary
- Server-to-server work uses `Authorization: Bearer ...` against `https://api.whop.com/api/v1`.
- Embedded app requests inside a Whop iframe identify the current user through `x-whop-user-token`.
- Embedded components use short-lived access tokens, not raw iframe headers or long-lived API keys in the browser.
- Webhooks must be verified before side effects, and sandbox and production assets must stay fully separate.

### 7. Keep Whop IDs and environments explicit

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · api-workflows.md (reported line 18)May include surrounding context.

md

- Checkout configurations: `/checkout_configurations`
- Webhooks: `/webhooks`
- Files: `/files`
- Access tokens: `/access_tokens`
- Stats: `/stats/describe`, `/stats/raw`, `/stats/sql`, `/stats/metric`

Use those as the default discovery path before reaching for rarer resources.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

|--------|------------|------------------|-------|
| Server-to-server REST | `Authorization: Bearer ...` | Backend requests to `https://api.whop.com/api/v1` | Official API accepts a company API key, company scoped JWT, app API key, or user OAuth token as bearer auth |
| Embedded Whop app iframe | `x-whop-user-token` | Requests from the Whop iframe to the app origin | Verify before trusting it; it is not a general API credential |
| Embedded web or mobile components | Short-lived access token from `POST /access_tokens` | Browser or mobile component initialization | Use for official embedded components instead of long-lived secrets |

## REST API Basics

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · api-workflows.md (reported line 100)May include surrounding context.

md

|--------|------------|------------------|-------|
| Server-to-server REST | `Authorization: Bearer ...` | Backend requests to `https://api.whop.com/api/v1` | Official API accepts a company API key, company scoped JWT, app API key, or user OAuth token as bearer auth |
| Embedded Whop app iframe | `x-whop-user-token` | Requests from the Whop iframe to the app origin | Verify before trusting it; it is not a general API credential |
| Embedded web or mobile components | Short-lived access token from `POST /access_tokens` | Browser or mobile component initialization | Use for official embedded components instead of long-lived secrets |

## REST API Basics

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · api-workflows.md (reported line 160)May include surrounding context.

md

|--------|------------|------------------|-------|
| Server-to-server REST | `Authorization: Bearer ...` | Backend requests to `https://api.whop.com/api/v1` | Official API accepts a company API key, company scoped JWT, app API key, or user OAuth token as bearer auth |
| Embedded Whop app iframe | `x-whop-user-token` | Requests from the Whop iframe to the app origin | Verify before trusting it; it is not a general API credential |
| Embedded web or mobile components | Short-lived access token from `POST /access_tokens` | Browser or mobile component initialization | Use for official embedded components instead of long-lived secrets |

## REST API Basics

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · auth-permissions.md (reported line 11)May include surrounding context.

md

|--------|------------|------------------|-------|
| Server-to-server REST | `Authorization: Bearer ...` | Backend requests to `https://api.whop.com/api/v1` | Official API accepts a company API key, company scoped JWT, app API key, or user OAuth token as bearer auth |
| Embedded Whop app iframe | `x-whop-user-token` | Requests from the Whop iframe to the app origin | Verify before trusting it; it is not a general API credential |
| Embedded web or mobile components | Short-lived access token from `POST /access_tokens` | Browser or mobile component initialization | Use for official embedded components instead of long-lived secrets |

## REST API Basics

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · auth-permissions.md (reported line 87)May include surrounding context.

https://whop.com/apps/app_xxxxxxxxx/install

text

## OAuth and Access Tokens

Use OAuth when the integration needs delegated user access outside the embedded iframe path.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md

| Surface | Credential | Where it belongs | Notes |
|--------|------------|------------------|-------|
| Server-to-server REST | `Authorization: Bearer ...` | Backend requests to `https://api.whop.com/api/v1` | Official API accepts a company API key, company scoped JWT, app API key, or user OAuth token as bearer auth |
| Embedded Whop app iframe | `x-whop-user-token` | Requests from the Whop iframe to the app origin | Verify before trusting it; it is not a general API credential |
| Embedded web or mobile components | Short-lived access token from `POST /access_tokens` | Browser or mobile component initialization | Use for official embedded components instead of long-lived secrets |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md

| Surface | Credential | Where it belongs | Notes |
|--------|------------|------------------|-------|
| Server-to-server REST | `Authorization: Bearer ...` | Backend requests to `https://api.whop.com/api/v1` | Official API accepts a company API key, company scoped JWT, app API key, or user OAuth token as bearer auth |
| Embedded Whop app iframe | `x-whop-user-token` | Requests from the Whop iframe to the app origin | Verify before trusting it; it is not a general API credential |
| Embedded web or mobile components | Short-lived access token from `POST /access_tokens` | Browser or mobile component initialization | Use for official embedded components instead of long-lived secrets |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-workflows.md (reported line 43)May include surrounding context.

md

| Surface | Credential | Where it belongs | Notes |
|--------|------------|------------------|-------|
| Server-to-server REST | `Authorization: Bearer ...` | Backend requests to `https://api.whop.com/api/v1` | Official API accepts a company API key, company scoped JWT, app API key, or user OAuth token as bearer auth |
| Embedded Whop app iframe | `x-whop-user-token` | Requests from the Whop iframe to the app origin | Verify before trusting it; it is not a general API credential |
| Embedded web or mobile components | Short-lived access token from `POST /access_tokens` | Browser or mobile component initialization | Use for official embedded components instead of long-lived secrets |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-workflows.md (reported line 50)May include surrounding context.

md

| Surface | Credential | Where it belongs | Notes |
|--------|------------|------------------|-------|
| Server-to-server REST | `Authorization: Bearer ...` | Backend requests to `https://api.whop.com/api/v1` | Official API accepts a company API key, company scoped JWT, app API key, or user OAuth token as bearer auth |
| Embedded Whop app iframe | `x-whop-user-token` | Requests from the Whop iframe to the app origin | Verify before trusting it; it is not a general API credential |
| Embedded web or mobile components | Short-lived access token from `POST /access_tokens` | Browser or mobile component initialization | Use for official embedded components instead of long-lived secrets |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-workflows.md (reported line 53)May include surrounding context.

md

| Surface | Credential | Where it belongs | Notes |
|--------|------------|------------------|-------|
| Server-to-server REST | `Authorization: Bearer ...` | Backend requests to `https://api.whop.com/api/v1` | Official API accepts a company API key, company scoped JWT, app API key, or user OAuth token as bearer auth |
| Embedded Whop app iframe | `x-whop-user-token` | Requests from the Whop iframe to the app origin | Verify before trusting it; it is not a general API credential |
| Embedded web or mobile components | Short-lived access token from `POST /access_tokens` | Browser or mobile component initialization | Use for official embedded components instead of long-lived secrets |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-workflows.md (reported line 82)May include surrounding context.

md

| Surface | Credential | Where it belongs | Notes |
|--------|------------|------------------|-------|
| Server-to-server REST | `Authorization: Bearer ...` | Backend requests to `https://api.whop.com/api/v1` | Official API accepts a company API key, company scoped JWT, app API key, or user OAuth token as bearer auth |
| Embedded Whop app iframe | `x-whop-user-token` | Requests from the Whop iframe to the app origin | Verify before trusting it; it is not a general API credential |
| Embedded web or mobile components | Short-lived access token from `POST /access_tokens` | Browser or mobile component initialization | Use for official embedded components instead of long-lived secrets |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-workflows.md (reported line 107)May include surrounding context.

md

| Surface | Credential | Where it belongs | Notes |
|--------|------------|------------------|-------|
| Server-to-server REST | `Authorization: Bearer ...` | Backend requests to `https://api.whop.com/api/v1` | Official API accepts a company API key, company scoped JWT, app API key, or user OAuth token as bearer auth |
| Embedded Whop app iframe | `x-whop-user-token` | Requests from the Whop iframe to the app origin | Verify before trusting it; it is not a general API credential |
| Embedded web or mobile components | Short-lived access token from `POST /access_tokens` | Browser or mobile component initialization | Use for official embedded components instead of long-lived secrets |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-workflows.md (reported line 123)May include surrounding context.

md

| Surface | Credential | Where it belongs | Notes |
|--------|------------|------------------|-------|
| Server-to-server REST | `Authorization: Bearer ...` | Backend requests to `https://api.whop.com/api/v1` | Official API accepts a company API key, company scoped JWT, app API key, or user OAuth token as bearer auth |
| Embedded Whop app iframe | `x-whop-user-token` | Requests from the Whop iframe to the app origin | Verify before trusting it; it is not a general API credential |
| Embedded web or mobile components | Short-lived access token from `POST /access_tokens` | Browser or mobile component initialization | Use for official embedded components instead of long-lived secrets |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-workflows.md (reported line 132)May include surrounding context.

md

| Surface | Credential | Where it belongs | Notes |
|--------|------------|------------------|-------|
| Server-to-server REST | `Authorization: Bearer ...` | Backend requests to `https://api.whop.com/api/v1` | Official API accepts a company API key, company scoped JWT, app API key, or user OAuth token as bearer auth |
| Embedded Whop app iframe | `x-whop-user-token` | Requests from the Whop iframe to the app origin | Verify before trusting it; it is not a general API credential |
| Embedded web or mobile components | Short-lived access token from `POST /access_tokens` | Browser or mobile component initialization | Use for official embedded components instead of long-lived secrets |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · auth-permissions.md (reported line 9)May include surrounding context.

md

| Surface | Credential | Where it belongs | Notes |
|--------|------------|------------------|-------|
| Server-to-server REST | `Authorization: Bearer ...` | Backend requests to `https://api.whop.com/api/v1` | Official API accepts a company API key, company scoped JWT, app API key, or user OAuth token as bearer auth |
| Embedded Whop app iframe | `x-whop-user-token` | Requests from the Whop iframe to the app origin | Verify before trusting it; it is not a general API credential |
| Embedded web or mobile components | Short-lived access token from `POST /access_tokens` | Browser or mobile component initialization | Use for official embedded components instead of long-lived secrets |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · auth-permissions.md (reported line 15)May include surrounding context.

md

| Surface | Credential | Where it belongs | Notes |
|--------|------------|------------------|-------|
| Server-to-server REST | `Authorization: Bearer ...` | Backend requests to `https://api.whop.com/api/v1` | Official API accepts a company API key, company scoped JWT, app API key, or user OAuth token as bearer auth |
| Embedded Whop app iframe | `x-whop-user-token` | Requests from the Whop iframe to the app origin | Verify before trusting it; it is not a general API credential |
| Embedded web or mobile components | Short-lived access token from `POST /access_tokens` | Browser or mobile component initialization | Use for official embedded components instead of long-lived secrets |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · auth-permissions.md (reported line 21)May include surrounding context.

md

| Surface | Credential | Where it belongs | Notes |
|--------|------------|------------------|-------|
| Server-to-server REST | `Authorization: Bearer ...` | Backend requests to `https://api.whop.com/api/v1` | Official API accepts a company API key, company scoped JWT, app API key, or user OAuth token as bearer auth |
| Embedded Whop app iframe | `x-whop-user-token` | Requests from the Whop iframe to the app origin | Verify before trusting it; it is not a general API credential |
| Embedded web or mobile components | Short-lived access token from `POST /access_tokens` | Browser or mobile component initialization | Use for official embedded components instead of long-lived secrets |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · auth-permissions.md (reported line 41)May include surrounding context.

md

| Surface | Credential | Where it belongs | Notes |
|--------|------------|------------------|-------|
| Server-to-server REST | `Authorization: Bearer ...` | Backend requests to `https://api.whop.com/api/v1` | Official API accepts a company API key, company scoped JWT, app API key, or user OAuth token as bearer auth |
| Embedded Whop app iframe | `x-whop-user-token` | Requests from the Whop iframe to the app origin | Verify before trusting it; it is not a general API credential |
| Embedded web or mobile components | Short-lived access token from `POST /access_tokens` | Browser or mobile component initialization | Use for official embedded components instead of long-lived secrets |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · webhooks-and-sandbox.md (reported line 27)May include surrounding context.

md

| Surface | Credential | Where it belongs | Notes |
|--------|------------|------------------|-------|
| Server-to-server REST | `Authorization: Bearer ...` | Backend requests to `https://api.whop.com/api/v1` | Official API accepts a company API key, company scoped JWT, app API key, or user OAuth token as bearer auth |
| Embedded Whop app iframe | `x-whop-user-token` | Requests from the Whop iframe to the app origin | Verify before trusting it; it is not a general API credential |
| Embedded web or mobile components | Short-lived access token from `POST /access_tokens` | Browser or mobile component initialization | Use for official embedded components instead of long-lived secrets |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file positions itself as the default starting point for 'most Whop work' and for broad goals like making money, improving conversion, or launching something new, without clear scope limits or safety boundaries. That can cause the skill to activate for overly broad business requests and steer users into revenue-growth guidance even when a narrower or more appropriate skill should handle the request, increasing the chance of misapplication and unsafe downstream advice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trial section notes that Whop automatically charges after the trial ends, but it frames this as platform behavior rather than instructing the agent to clearly warn users and customers about the auto-conversion risk. In a checkout optimization context, omitting a prominent disclosure requirement can lead to deceptive flows, unexpected charges, complaints, refunds, and regulatory or platform-trust issues.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.