WhatsApp OpenAPI Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:38 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for WhatsApp Cloud API use, but its setup pulls a mutable remote API schema that can change what the authenticated CLI does.

Review the setup before installing. Prefer linking UXC to the bundled `references/whatsapp-cloud.openapi.json` file or to an immutable reviewed commit, protect the WhatsApp access token, and confirm every message send or business profile update before execution.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:65

Finding

Mutable Remote OpenAPI Schema Controls Generated CLI Behavior

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 65-69
Vulnerability Type: Supply-chain risk through an unpinned remote dependency
Risk Level: Medium

bash

command -v whatsapp-openapi-cli
# If missing, create it:
uxc link whatsapp-openapi-cli https://graph.facebook.com/v25.0 --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/whatsapp-openapi-skill/references/whatsapp-cloud.openapi.json
whatsapp-openapi-cli -h

Technical Analysis

The documented setup command instructs UXC to generate or link the WhatsApp CLI using an OpenAPI schema retrieved from the mutable main branch of an external GitHub repository. The URL is not pinned to a reviewed commit, release artifact, or cryptographic digest.

Although the project includes a local audited schema at references/whatsapp-cloud.openapi.json, the default setup does not use it. Consequently, the effective API definition consumed at installation time may differ from the version reviewed with this package. An upstream repository compromise or unauthorized schema change could modify server metadata, exposed operations, parameters, or request construction.

The bearer credential is bound to graph.facebook.com and /v25.0, which limits some credential-redirection scenarios. However, this binding does not preserve the integrity of operations generated from the remote schema.

The same vulnerable pattern also appears in references/usage-patterns.md, lines 5-7:

bash

uxc link whatsapp-openapi-cli https://graph.facebook.com/v25.0 \
  --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/whatsapp-openapi-skill/references/whatsapp-cloud.openapi.json

Attack Path

1. An attacker compromises the referenced upstream repository or obtains permission to modify its main branch.
2. The attacker changes whatsapp-cloud.openapi.json, altering API operations, parameters, request bodies, or server-related metadata.
3. A user follows the documented ...[truncated 1186 chars]

Remediation

View remediation

Remediation Suggestions

1. Use the schema bundled with the reviewed skill package instead of retrieving it from a remote branch:

   bash

   uxc link whatsapp-openapi-cli https://graph.facebook.com/v25.0 \
     --schema-url ./references/whatsapp-cloud.openapi.json
   

   If UXC requires an absolute path or file URI, resolve the package directory and supply the corresponding local URI.

2. If remote retrieval is operationally required, pin the URL to an immutable reviewed commit rather than main:

   text

   https://raw.githubusercontent.com/holon-run/uxc/<reviewed-commit>/skills/whatsapp-openapi-skill/references/whatsapp-cloud.openapi.json
   

3. Publish and verify a SHA-256 digest before passing the downloaded schema to UXC. Abort setup if verification fails.

4. Update both SKILL.md and references/usage-patterns.md so all installation examples use the same pinned or local schema.

5. Extend scripts/validate.sh to reject schema URLs containing mutable branch names such as main and to verify that documentation references either the bundled schema or an approved immutable commit.

6. Retain the existing host, HTTPS scheme, and /v25.0 path credential binding as defense in depth.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

- Access to the curated OpenAPI schema URL:
  - `https://raw.githubusercontent.com/holon-run/uxc/main/skills/whatsapp-openapi-skill/references/whatsapp-cloud.openapi.json`
- A Meta app and WhatsApp Business account with Cloud API access.
- A valid system-user or app access token that can call the target WhatsApp assets.
- At least one `phone_number_id`, and for phone number listing, the related `waba_id`.

## Scope

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/whatsapp-cloud.openapi.json (reported line 188)May include surrounding context.

json

- Access to the curated OpenAPI schema URL:
  - `https://raw.githubusercontent.com/holon-run/uxc/main/skills/whatsapp-openapi-skill/references/whatsapp-cloud.openapi.json`
- A Meta app and WhatsApp Business account with Cloud API access.
- A valid system-user or app access token that can call the target WhatsApp assets.
- At least one `phone_number_id`, and for phone number listing, the related `waba_id`.

## Scope

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

- Usage patterns: `references/usage-patterns.md`
- Curated OpenAPI schema: `references/whatsapp-cloud.openapi.json`
- WhatsApp Cloud API docs: https://developers.facebook.com/docs/whatsapp/cloud-api
- Graph API access tokens: https://developers.facebook.com/docs/graph-api/overview/access-tokens/

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file documents binding a bearer credential from WHATSAPP_CLOUD_ACCESS_TOKEN, which is a sensitive secret. While the steps are functional, the file does not warn users to protect the token, avoid exposing it in shells/logs, or ensure it is sourced securely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This manifest file defines a POST operation that sends WhatsApp messages and necessarily transmits user-supplied recipient phone numbers and message payloads to Meta's Graph API. The specification includes no warning, confirmation language, or privacy disclosure in the endpoint summary/description despite involving outbound transmission of user data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The template message example specifies "language":{"code":"en_US"} directly, which can be read as forcing a specific locale. The file does not state that locale should be selected based on user preference or adjusted for the recipient's language.

Content

No source excerpt is available for this finding.