ClawHub
Back to skill

Security audit

skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent WhatsApp Business API guide, but it gives agents customer-messaging and destructive business-resource actions with weak safety guidance and includes a credential-revealing troubleshooting command.

Review this skill before installing in any production WhatsApp Business environment. Use least-privilege Maton credentials, avoid printing or sharing MATON_API_KEY, confirm recipients and message content before sends, and require explicit confirmation plus resource validation before deleting connections, media, or templates or changing the business profile.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:598
Finding

API Key Disclosed Through Troubleshooting Command

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 598-602
Vulnerability Type: Sensitive credential exposure
Risk Level: Medium

Vulnerable Code

bash
# Check that the MATON_API_KEY environment variable is set:

echo $MATON_API_KEY

Technical Analysis

The troubleshooting procedure prints the complete MATON_API_KEY credential to standard output. Revealing the credential is not necessary to determine whether the environment variable is configured.

Terminal output may be retained in CI/CD logs, remote shell recordings, screen captures, debugging transcripts, or support tickets. Although the key is legitimately sent in an HTTPS Authorization header when accessing Maton services, displaying it in plaintext creates a separate and avoidable disclosure channel.

Attack Path

  1. A user encounters an authentication problem and follows the documented troubleshooting instructions.
  2. The echo $MATON_API_KEY command prints the complete bearer credential.
  3. The output is recorded by a logging system, captured in a screenshot, or copied into a support conversation.
  4. An attacker or unauthorized user obtains access to that output.
  5. The attacker submits the exposed key as a bearer credential to Maton endpoints.
  6. Subject to the permissions and connections associated with the key, the attacker may access connection metadata or perform WhatsApp Business operations.

Exploitation requires an attacker to obtain the disclosed terminal output; the documentation does not itself transmit the printed value to an additional endpoint.

Impact Assessment

Disclosure could permit unauthorized use of the Maton account and its associated WhatsApp Business connections within the exposed key's permissions. Potential effects include reading connection metadata, sending messages, managing templates or media, modifying business profile information, and consuming account rate limits.

The exact scope i ...[truncated 202 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the disclosure command with a presence check that never prints the credential:

    bash
    if [ -n "${MATON_API_KEY:-}" ]; then
  echo "MATON_API_KEY is set"
else
  echo "MATON_API_KEY is not set"
fi

  • If partial identification is operationally necessary, display only a short, non-sensitive fingerprint generated locally rather than any portion of the raw key.

  • Explicitly warn users not to paste API keys or authorization headers into logs, screenshots, issue trackers, or support conversations.

  • Configure CI and support tooling to redact MATON_API_KEY and Authorization: Bearer values.

  • Rotate the API key immediately if it has already appeared in logs or other material accessible to unauthorized parties.

  • Apply the least privileges available to the key and monitor Maton account activity for unexpected connection-management or WhatsApp Business operations.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
88% confidence
Finding

A documented DELETE endpoint for media creates a high-risk capability for destructive actions driven by caller-supplied identifiers. In an agentic context, insufficient guardrails around such parameters can enable accidental or unauthorized deletion of business assets, especially when IDs are copied from prior outputs or user prompts without validation.

Content

Scanner excerpt · SKILL.md (reported line 398)May include surrounding context.

Delete Media

bash
DELETE /whatsapp-business/v21.0/{media_id}

Message Templates

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
89% confidence
Finding

This DELETE template endpoint accepts account and template identifiers directly and can remove messaging templates that may be in production use. In the context of a WhatsApp business integration, that can disrupt customer communications, break workflows, or create operational outages if invoked with the wrong parameters.

Content

Scanner excerpt · SKILL.md (reported line 446)May include surrounding context.

Delete Template

bash
DELETE /whatsapp-business/v21.0/{whatsapp_business_account_id}/message_templates?name=template_name

Phone Numbers

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill is explicitly designed to send WhatsApp messages and manage customer-facing resources through external services, but it does not clearly warn that recipient identifiers, message content, and business data are transmitted to third-party endpoints. In an agent setting, this omission can cause users or downstream systems to trigger privacy-sensitive actions without informed consent or awareness of external disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation includes destructive actions such as deleting OAuth connections, media, and templates without caution about irreversibility, service disruption, or customer impact. In an agent-driven workflow, this increases the chance of accidental deletion of production resources through routine parameter substitution or misuse.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The JavaScript fetch example performs an external authenticated transmission of message content and recipient information. In a skill environment, examples often become copy-pasted operational behavior, so missing privacy and side-effect warnings can lead to inadvertent disclosure or unintended messaging.

Content

Scanner excerpt · SKILL.md (reported line 499)May include surrounding context.

md
};

// Send text message
await fetch(
  'https://gateway.maton.ai/whatsapp-business/v21.0/PHONE_NUMBER_ID/messages',
  {
    method: 'POST',

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This JavaScript template-message example also sends authenticated data to an external messaging gateway and can trigger real outbound customer communication. The risk is amplified by the skill's focus on operational messaging without equally strong guardrails about data disclosure and side effects.

Content

Scanner excerpt · SKILL.md (reported line 514)May include surrounding context.

md
);

// Send template message
await fetch(
  'https://gateway.maton.ai/whatsapp-business/v21.0/PHONE_NUMBER_ID/messages',
  {
    method: 'POST',

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This duplicated finding refers to the same external POST example that transmits recipient and message data to the remote gateway. In this skill, the behavior is intended, but it remains a true security/privacy concern because users are not adequately warned about outbound data transfer and customer-facing effects.

Content

Scanner excerpt · SKILL.md (reported line 544)May include surrounding context.

md
}

# Send text message
response = requests.post(
    'https://gateway.maton.ai/whatsapp-business/v21.0/PHONE_NUMBER_ID/messages',
    headers=headers,
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This duplicated finding refers to the same external POST example that transmits recipient and message data to the remote gateway. In this skill, the behavior is intended, but it remains a true security/privacy concern because users are not adequately warned about outbound data transfer and customer-facing effects.

Content

Scanner excerpt · SKILL.md (reported line 544)May include surrounding context.

md
}

# Send text message
response = requests.post(
    'https://gateway.maton.ai/whatsapp-business/v21.0/PHONE_NUMBER_ID/messages',
    headers=headers,
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This duplicated finding corresponds to the template-message POST example that sends data externally. The context makes the transmission expected, but not harmless: a misdirected or unauthorized invocation could send real business communications to customers.

Content

Scanner excerpt · SKILL.md (reported line 556)May include surrounding context.

md
)

# Send template message
response = requests.post(
    'https://gateway.maton.ai/whatsapp-business/v21.0/PHONE_NUMBER_ID/messages',
    headers=headers,
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This duplicated finding corresponds to the template-message POST example that sends data externally. The context makes the transmission expected, but not harmless: a misdirected or unauthorized invocation could send real business communications to customers.

Content

Scanner excerpt · SKILL.md (reported line 556)May include surrounding context.

md
)

# Send template message
response = requests.post(
    'https://gateway.maton.ai/whatsapp-business/v21.0/PHONE_NUMBER_ID/messages',
    headers=headers,
    json={

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This file repeatedly specifies the locale code en_US in template examples, which can be read as prescribing a specific language/locale. SQP-3 applies because the documentation does not offer a language choice or explicitly state that users should select the locale appropriate for their audience.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_resource_identifier

Example code exposes a concrete connection_id instead of a placeholder.

Critical
Code
suspicious.exposed_resource_identifier
Location
SKILL.md:105