WhatsApp Lead Hunter

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:15 AM UTC
• Version: 1.0.0

Overview

The skill is coherent but needs Review because it automates scraped-contact WhatsApp outreach and includes an unsafe batch sender that can expose credentials or run unintended code.

Review this before installing. Use it only with legally obtained contacts and proper opt-out/consent handling. Do not run the batch sender with untrusted lead filenames, do not pass real WAHA keys on the command line, prefer dry-run first, restrict WAHA to trusted local or HTTPS endpoints, and define how scraped phone numbers and ignore lists will be retained or deleted.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/batch_send.sh:58

Finding

Arbitrary Python Code Execution Through Unsafely Interpolated Lead File Path

Content

View full analysis

--waha-key `. 3. The `-f` check succeeds because a file exists under the crafted name. 4. The shell expands `$LEADS` inside the double-quoted `python3 -c` argument. 5. Embedded quote characters terminate the Python string passed to `open()`, and the remaining filename content is parsed as Python statements. 6. ...[truncated 961 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/batch_send.sh:44

Finding

WAHA API Key Exposed Through Command-Line Arguments

Content

View full analysis

/cmdline`, subject to local access controls. - Shell history. - Job-control, monitoring, auditing, and orchestration systems. - Diagnostic logs that record command invocations. The exposure window can be lengthy because the script intentionally sleeps between messages. The documentation states that the key may be passed as a parameter or environment variable, but the implementation does not initialize the key from an environment variable. The key is also placed in the `curl` header argument during each request: ```bash -H "X-Api-Key: $WAHA_KEY" ``` This creates additional, shorter process-metadata exposure while each `curl` process is active. ### Attack Path 1. An operator starts a batch using `--waha-key `. 2. The batch remains active while sending messages and sleeping between recipients. 3. A local user, monitoring agent, support utility, or process with sufficient process-inspect ...[truncated 1129 chars]

Remediation

View remediation

&2 exit 1 } WAHA_KEY=$(cat -- "$WAHA_KEY_FILE") fi ``` Additional hardening should include: 1. Deprecate and then remove `--waha-key`. 2. Update `SKILL.md` examples so they never place a real key in command arguments. 3. Read secrets from a dedicated secret manager when used in CI or orchestration environments. 4. Restrict WAHA keys to the minimum API permissions required for sending text. 5. Restrict the WAHA listener to trusted interfaces and clients. 6. Prefer HTTPS for non-loopback WAHA URLs to prevent network interception. 7. Rotate any key that has previously appeared in command history or logs. 8. Ensure diagnostic output never prints request headers or secret values. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/batch_send.sh (reported line 87)May include surrounding context.

sh

if [ "$DRY_RUN" = true ]; then
    echo "[$SENT/$TOTAL] 📝 Would send to $NAME ($PHONE)"
  else
    RESULT=$(curl -s -X POST "$WAHA_URL/api/sendText" \
      -H "X-Api-Key: $WAHA_KEY" \
      -H "Content-Type: application/json" \
      -d "{\"session\": \"$SESSION\", \"chatId\": \"${PHONE}@c.us\", \"text\": $(echo "$MSG" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))')}" 2>/dev/null)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill clearly instructs use of shell-based capabilities via curl and scripts/batch_send.sh, yet it declares no allowed tool scope or permissions. This creates an authorization gap where an agent may execute networked shell actions without explicit user-visible restriction, increasing the chance of unintended message sending or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is designed to scrape business contact details, store them locally, profile businesses, and send cold WhatsApp outreach, but it provides no consent, retention, lawful-basis, or privacy notice guidance. That omission makes unauthorized collection, processing, and messaging of personal or business contact data much more likely, with legal, compliance, and reputational consequences.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The skill includes a concrete example for transmitting personalized outreach messages and recipient identifiers to an HTTP API endpoint. Even though the target is localhost, this is still external transmission from the agent context to another service and can enable unauthorized messaging, data leakage to an improperly secured local service, or abuse if the endpoint is exposed or proxied.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

4. Send via WAHA

bash

curl -X POST "http://localhost:3000/api/sendText" \
  -H "X-Api-Key: YOUR_WAHA_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The veterinary template explicitly promotes automated reminders, customer records, and animal/patient-related data handling without any mention of consent, lawful basis, retention, or privacy safeguards. In a lead-generation and WhatsApp outreach skill, this omission can encourage users to deploy workflows that process personal and potentially sensitive data in ways that violate privacy expectations or regulations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The dental clinic template discusses patient history, recall reminders, and promotional outreach tied to dental services, but provides no warning about privacy, confidentiality, consent, or health-data handling. Because this skill is designed for automated WhatsApp marketing and operational messaging, it materially increases the chance of unsafe processing or disclosure of sensitive health-related information.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 73% confidence

Finding

The script sends phone numbers and personalized message contents to an arbitrary operator-supplied WAHA_URL without validating that the endpoint is trusted or protected by HTTPS. In a lead-generation/outreach skill handling personal contact data, this can expose recipient data to interception or to a malicious remote service if the URL is misconfigured.

Content

Scanner excerpt · scripts/batch_send.sh (reported line 87)May include surrounding context.

sh

if [ "$DRY_RUN" = true ]; then
    echo "[$SENT/$TOTAL] 📝 Would send to $NAME ($PHONE)"
  else
    RESULT=$(curl -s -X POST "$WAHA_URL/api/sendText" \
      -H "X-Api-Key: $WAHA_KEY" \
      -H "Content-Type: application/json" \
      -d "{\"session\": \"$SESSION\", \"chatId\": \"${PHONE}@c.us\", \"text\": $(echo "$MSG" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))')}" 2>/dev/null)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The curl POST sends lead phone numbers, session identifiers, and message text to an HTTP API endpoint. Although the script logs that WAHA will be used, it does not clearly warn that personal lead data and message contents are being transmitted over the network or that the default URL is plain HTTP.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The file mixes Turkish and English sector/location examples and sector labels, implying a locale-specific operating pattern, but it does not explicitly offer the user a language or locale choice for generated outreach. Because the policy applies to natural-language constraints across all file types, hardwiring locale behavior without opt-in can be a language/locale policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script persists phone numbers to the path provided by --ignore-file, which is a file write involving personal contact data. While the argument description mentions appending sent numbers, there is no explicit warning in runtime output or safety note about storing recipient identifiers on disk.

Content

No source excerpt is available for this finding.