ClawHub
Back to skill

Security audit

WhatsApp Contacts

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it reads locally cached WhatsApp contact data and prints requested contact results, without persistence, network transfer, or hidden behavior.

Install only if you are comfortable letting the agent read and display contacts from the local WhatsApp Baileys cache for the default OpenClaw WhatsApp account. Treat the output as private contact metadata and avoid using it in conversations or workflows where you do not want phone numbers or contact names exposed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill invokes a local Node.js script via exec but does not declare any tool scope, permissions, or allowed-tools restrictions in the skill manifest. That creates an implicit trust boundary issue: an agent may be permitted to execute shell commands and access environment-derived session data without explicit authorization, increasing the chance of unintended code execution or data exposure from the local Baileys cache.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script is hardwired to read from the local WhatsApp credential/session directory under the OpenClaw state path, which is a sensitive data location containing session-derived information. Even though this code reads contacts rather than credentials directly, accessing this protected cache without disclosure or trust boundaries is dangerous because it enables silent harvesting of private messaging metadata from the host environment.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script enumerates and prints cached WhatsApp contacts, including names and phone numbers, directly to stdout with no consent check, access control, or warning. In an agent-skill context, this creates a clear privacy/data-exfiltration risk because any caller who can invoke the skill can retrieve sensitive address-book data from the local Baileys cache.

Static analysis

No suspicious patterns detected.