Security audit

WhatsApp Groups

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it reads local WhatsApp Baileys session data to list groups, with one config-writing sync command users should understand before running.

Install only if you are comfortable with a skill reading local WhatsApp Baileys session-derived files and printing group names and IDs. Review output carefully, and run sync only when you want it to modify openclaw.json with newly discovered groups.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes a Node.js script to inspect Baileys session cache data but does not declare any tool scope or permissions boundaries in the manifest. That omission makes the skill's data-access behavior less transparent and easier to misuse, especially because session-derived WhatsApp metadata can reveal private group identifiers and membership context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly states it reads Baileys session cache files to discover WhatsApp groups, but it provides no warning that this accesses sensitive session-derived metadata and can expose private group names and IDs. In this context, missing disclosure increases the risk of users invoking the skill without understanding that it enumerates potentially confidential communication structures.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script reads sensitive WhatsApp session-derived artifacts (`sender-key-*`, `store.json`, `contacts.json`) to enumerate groups and names, which can reveal private relationship and metadata information. Even without exfiltration, accessing this data without clear disclosure or consent expands the skill's privacy risk and may surprise users who expect narrower behavior.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill metadata presents the capability as discovery, listing, and search, but the `sync` path also mutates `openclaw.json` by inserting group entries. This mismatch is security-relevant because users or higher-level tooling may treat the skill as read-only while it actually performs persistent state changes on disk.

Intent-Code Divergence

Low

Confidence: 83% confidence
Finding: The inline file description explicitly says 'Discover and manage groups', which signals broader administrative behavior than the manifest's read-oriented description. This is reinforced by the presence of sync behavior that writes configuration, creating an intent mismatch between documented scope and declared skill purpose.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The `sync` command writes the updated configuration back to disk without an explicit warning at execution time, creating a persistent side effect that users may not anticipate. In agent/tooling contexts, silent writes can lead to configuration drift or enable groups unintentionally once later edited or activated.

Static analysis

No suspicious patterns detected.