Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent for WAHA WhatsApp onboarding, but it links a WhatsApp account and exposes a phone number in session metadata without enough scope, privacy, or revocation guidance.
Review this skill before installing if you are comfortable linking WhatsApp through WAHA. Only use it with a WAHA deployment you trust, and remove the linked device in WhatsApp when access is no longer needed. Prefer a version that avoids phone numbers in session names and includes explicit consent, scope, retention, and revocation instructions.
The skill explicitly asks for and sanitizes a user's phone number, then uses it as a session identifier, but provides no privacy notice, retention guidance, or warning about how this personal data will be processed. Phone numbers are sensitive identifiers, and embedding them directly into session names increases exposure through logs, command history, and operational metadata.
The skill requests a WhatsApp pairing code and instructs the user to link their account, but does not clearly warn that this action authorizes a session with access to the user's WhatsApp data and actions. Without explicit consent and scope disclosure, a user may unknowingly grant broad account access, which could lead to message exposure, impersonation, or unauthorized account operations if the session is misused.
No suspicious patterns detected.
