Security audit

Evolution WhatsApp

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says by controlling WhatsApp through Evolution API, but it handles sensitive messaging data and credentials with under-disclosed privacy impact and unsafe configuration loading.

Review this before installing if you would use it with real WhatsApp accounts. Use only an Evolution API endpoint you control and trust, require HTTPS, use a limited and rotatable token, avoid placing executable content in artifact/.env, and get consent before fetching or summarizing other people's chats, contacts, group data, or locations.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: evo.sh:8
Finding: Arbitrary Shell Execution Through Sourced .env Configuration
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: evo.sh:24
Finding: Sensitive Evolution API Traffic Can Be Sent Over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: Auto-loading credentials and configuration from a local .env file is risky because the file is treated as executable shell input. In a skill or shared-repository context, a malicious or tampered .env can both expose secrets and run arbitrary commands, making this more dangerous than normal local-only configuration loading.
Content: Scanner excerpt · evo.sh (reported line 8)May include surrounding context.
sh
# Load local config if exists (for personal use) SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" if [ -f "$SCRIPT_DIR/.env" ]; then source "$SCRIPT_DIR/.env" fi

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: The specific use of source means the .env file is executed in the current shell process, enabling arbitrary code execution and manipulation of all subsequent requests and credentials. In addition, a local file can silently override trusted environment variables and redirect API traffic to attacker-controlled infrastructure.
Content: Scanner excerpt · evo.sh (reported line 9)May include surrounding context.
sh
# Load local config if exists (for personal use) SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" if [ -f "$SCRIPT_DIR/.env" ]; then source "$SCRIPT_DIR/.env" fi # Helper function for API calls

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill enables sending messages and retrieving chats, messages, and contacts through a third-party Evolution API, but it does not clearly warn users that sensitive communications and contact data may be transmitted to and processed by an external service. This creates a real privacy and consent risk, especially if users assume actions are local or do not understand that using hosted infrastructure exposes message metadata and potentially content outside their device.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · evo.sh (reported line 24)May include surrounding context.
sh
fi if [ -n "$data" ]; then curl -s -X "$method" "${EVO_BASE_URL}${endpoint}" \ -H "apikey: ${EVO_INSTANCE_TOKEN}" \ -H "Content-Type: application/json" \ -d "$data"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The script sends text, media, audio, stickers, and location data over HTTP to an external WhatsApp API, but it does not provide a clear user-facing warning that supplied content and recipient identifiers will be transmitted off-host. The help text describes command usage, but not the privacy or external transmission impact.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This shell script includes commands to fetch chats, contacts, and messages from a WhatsApp instance, which can expose personal communications and contact data. While the functions are commented with technical descriptions, there is no user-facing warning in the usage output or other disclosure that these commands retrieve sensitive data.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script unconditionally sources a local .env file as shell code whenever it exists. Because source executes the file rather than safely parsing key/value pairs, anyone who can modify that file can achieve arbitrary command execution in the context of the user running the script, not just change configuration.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.