Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
WhatsApp Groups
v1.0.0Discover, list, and search WhatsApp groups from Baileys session data
⭐ 0· 548·0 current·0 all-time
byMarcos Santos@marcosrippel
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description claim to discover WhatsApp groups from Baileys session data and the script explicitly reads a Baileys credentials directory (OPENCLAW_STATE_DIR or ~/.openclaw/credentials/whatsapp/default), store.json, and contacts.json to find group IDs and names. All requested file access is coherent with that purpose.
Instruction Scope
SKILL.md directs the agent to run the included Node script (node scripts/groups.js) with specific commands (list, search, get-id, sync). The instructions do not ask the agent to read other unrelated files, call external endpoints, or collect extra system context beyond the expected state/config files.
Install Mechanism
No install spec; the skill is instruction + a single local script. Nothing is downloaded or extracted during install, so there is low install-time risk.
Credentials
The script reads the Baileys credentials directory which can contain sensitive session artifacts (sender-key files, possibly session/auth data). This is proportional to discovering groups, but it does mean the skill will read files that are sensitive. The skill does not request external API keys or unrelated credentials and respects OPENCLAW_STATE_DIR if set.
Persistence & Privilege
The 'sync' command modifies the agent's openclaw.json (STATE_DIR/openclaw.json) to add discovered groups. Writing this config is coherent with the claimed feature, but it does change agent configuration and could add many entries if run — users should be aware it will persist changes to openclaw.json.
Assessment
This skill appears to do what it says: it reads your local Baileys session files (by default in ~/.openclaw/credentials/whatsapp/default) to find group IDs/names and can add them to openclaw.json. Before installing: (1) review the included scripts/groups.js yourself (it is small and readable); (2) be aware these session directories can contain sensitive keys — the skill reads them but does not perform network calls or exfiltration; (3) back up openclaw.json before running sync (sync will modify that file); (4) run the script in a controlled environment or sandbox if you do not fully trust the skill owner.Like a lobster shell, security has layers — review code before you run it.
baileysvk972fx15ymanxps80j2etjhfy181fp1gdiscoveryvk972fx15ymanxps80j2etjhfy181fp1ggroupsvk972fx15ymanxps80j2etjhfy181fp1glatestvk972fx15ymanxps80j2etjhfy181fp1gofflinevk972fx15ymanxps80j2etjhfy181fp1gwhatsappvk972fx15ymanxps80j2etjhfy181fp1g
License
MIT-0
Free to use, modify, and redistribute. No attribution required.