ClawHub
Back to skill

Security audit

WhatsApp Labels

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small local WhatsApp Business label helper that reads local cache files and does not show hidden execution, persistence, network transfer, or destructive behavior.

Install only if you are comfortable allowing the skill to read local WhatsApp Business cache data, including contact names, IDs, and label relationships. It appears read-only and local, but the cache path is sensitive account-adjacent storage.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill invokes a Node.js script via exec but does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authorization gap where the runtime may permit broader capabilities than reviewers or users expect, especially since the script can inherit environment access and potentially expose local session data from the WhatsApp cache.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script directly targets a WhatsApp credential/session state directory and reads cached data files from it without any user-facing warning, consent prompt, or disclosure. Even though it appears intended to operate on local session data, accessing credential-adjacent stores can reveal sensitive contacts, labels, and account metadata if the skill is invoked unexpectedly or in a broader agent context.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The skill claims to list and search WhatsApp Business labels, but this code also enumerates contacts/chats associated with a label and outputs names and IDs. That expands from metadata lookup into disclosure of contact relationships and user data, which is privacy-sensitive and exceeds the stated capability.

Description-Behavior Mismatch

Low
Confidence
88% confidence
Finding
When no label cache is present, the code falls back to scanning contacts.json to derive labels from contact records. This broadens access from label data to contact data, creating unnecessary exposure to additional sensitive information beyond the advertised function.

Static analysis

No suspicious patterns detected.