SocialEpoch WhatsApp SCRM API 智能助手

• Outcome: Review
• Latest audit: May 27, 2026 · 10:55 PM UTC
• Version: 2.3.3

Overview

This skill provides WhatsApp SCRM functions, but it also changes local OpenClaw settings, installs packages, downloads and runs a native client, and manages local processes with weaker disclosure and controls than users should expect.

Install only if you trust SocialEpoch and are comfortable with the skill changing ~/.openclaw configuration, storing API credentials locally, installing Python packages, downloading and running a native client from download.anascrm.com, and sending or bulk-sending WhatsApp/customer data through the service. Verify the downloaded client through an out-of-band trusted source, restrict API keys, use consent-based messaging only, and review callback URLs before enabling auto-receive or bulk outreach.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

pip_args.extend(["--user", "--break-system-packages"])

    try:
        subprocess.check_call(
            pip_args,
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL

• Confidence: 92% confidence
• Finding: The skill automatically invokes pip at runtime to install packages, which modifies the local Python environment without explicit user consent. In this skill's context, that behavior is unnecessary for simple API access and increases supply-chain and environment-integrity risk if package resolution or indexes are compromised.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if os.name == "nt":
            startupinfo = subprocess.STARTUPINFO()
            startupinfo.dwFlags |= subprocess.STARTF_USESHOWWINDOW
            subprocess.call(
                ["taskkill", "/f", "/im", CLIENT_NAME],
                stdout=subprocess.PIPE,
                stderr=subprocess.PIPE,

• Confidence: 94% confidence
• Finding: This code force-kills any process matching the image name social_claw.exe, not a verified child process started by this script. That can terminate unrelated processes with the same name and is especially risky because the comments claim narrower behavior than the implementation actually enforces.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

startupinfo=startupinfo
            )
        else:
            subprocess.call(
                ["pkill", "-f", CLIENT_PATH],
                stdout=subprocess.PIPE,
                stderr=subprocess.PIPE

• Confidence: 95% confidence
• Finding: Using pkill -f on CLIENT_PATH kills processes based on command-line pattern matching, which may match more than the intended client. In a user environment, this can disrupt unrelated workloads and creates dangerous local side effects not justified by the advertised API wrapper purpose.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def start_client_process():
    try:
        if os.name == "nt":
            subprocess.Popen(
                [CLIENT_PATH],
                creationflags=subprocess.CREATE_NO_WINDOW,
                close_fds=True

• Confidence: 97% confidence
• Finding: The script executes a local binary that it previously downloaded into a user-writable directory, creating a direct path from network download to code execution. Because there is no signature or hash verification, a compromised download source or local path manipulation could lead to arbitrary code execution.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

close_fds=True
            )
        else:
            subprocess.Popen(
                [CLIENT_PATH],
                close_fds=True,
                stdout=subprocess.DEVNULL,

• Confidence: 97% confidence
• Finding: On non-Windows systems, the code launches the downloaded client from ~/.openclaw without integrity validation. This is dangerous because any attacker able to replace that file, or any compromise of the download host, gains code execution under the user's account.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions while its documented behavior and detected capabilities include environment access, file reads/writes, network activity, and shell/process execution. This is dangerous because users and platforms cannot make an informed trust decision, and the undocumented capability set is broad enough to alter local state, access secrets, and communicate externally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is an API integration, but the behavior extends to downloading an external binary, killing and launching local processes, modifying OpenClaw configuration, enabling gateway/memorySearch-related settings, and opening a browser dashboard. That mismatch is highly risky because it hides invasive host-level actions behind a benign messaging-tool description, increasing the chance of silent persistence, unsafe local exposure, or execution of untrusted code.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The security section claims there is no automatic startup or background execution, yet later commands explicitly describe persistent auto-receive with boot recovery. This contradiction is dangerous because it misleads users about persistence and background activity, reducing meaningful consent for a feature that may continuously receive messages and maintain a local running component.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill silently installs Python dependencies at runtime, including use of --break-system-packages on non-Windows systems. That behavior mutates the host environment, can destabilize managed Python installations, and adds avoidable supply-chain exposure for a skill that should be a straightforward API client.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill presents itself as an API integration but also rewrites local gateway configuration, downloads a native executable from the internet, kills processes, and launches the binary automatically. This combination materially expands the trust boundary and creates a strong arbitrary code execution and unauthorized system modification risk far beyond what users would reasonably expect from the description.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The comments explicitly reassure the reader that shutdown is narrowly scoped and safe, but the implementation uses broad taskkill/pkill matching. Misleading safety claims increase the risk because reviewers and users may approve behavior they would otherwise reject, while the actual code can terminate unrelated processes.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README promotes bulk messaging and callback configuration for customer communications but provides no guidance on consent, lawful basis, data minimization, webhook security, or handling of personal data. In an SCRM/WhatsApp automation context, this omission can lead users to deploy mass outreach and callback collection in ways that violate privacy expectations, expose customer data, or enable abusive messaging workflows.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: In force mode, the script deletes any existing client binary and replaces it with a newly downloaded one without warning, confirmation, or integrity verification. This creates both reliability risk and a path for silent replacement of executable code on the host.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill performs process termination without any user-facing disclosure, which is unsafe operationally and inconsistent with least surprise. In this context, hidden local side effects are particularly concerning because the skill is marketed primarily as an API integration, not a process manager.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The skill stores tenant credentials in a local JSON file under the user's home directory without warning or protection measures. If file permissions are weak, backups are exposed, or the host is shared, these API secrets may be recoverable and reused.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger list includes broad phrases such as 'SocialEpoch', '批量发送', '设置配置', and '打开Dashboard', which can match ordinary user requests and cause unintended activation of a high-privilege messaging skill. In this context, accidental invocation is risky because the skill can send WhatsApp messages, enable callbacks, and alter messaging-related configuration without a strong indication of user intent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The manifest advertises automatic message receipt, callback delivery, status callbacks, AI auto-reply, and bulk messaging, but does not provide corresponding user-facing warnings about third-party data transmission, retention, or consent. Because the skill handles communications content and potentially customer data, this omission can lead users to unknowingly expose sensitive messages, contact lists, and metadata to an external service.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill declares 'privacy': 'none' even though it collects secrets (ApiKey, tenantId), sends WhatsApp messages, supports callbacks, auto-receives messages, and processes customer communications. This materially understates the sensitivity of the data involved and may cause the platform or users to treat the skill as non-sensitive, increasing the chance of credential misuse, unauthorized data handling, and compliance violations.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

Static analysis

No suspicious patterns detected.