WhatsApp Business Al Assistant

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:47 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent WhatsApp automation tool, but its webhook script can accidentally expose saved credentials and customer data through a public ngrok tunnel.

Review carefully before installing. Do not run the included webhook starter as-is with real credentials: it can expose the skill folder publicly if the intended server is missing. Require a fixed webhook service that only serves /webhook, binds locally behind ngrok, rejects unrelated paths, and never serves .env, databases, or logs. Store tokens outside the web root with restrictive permissions, rotate any tokens used during testing, and verify customer consent, opt-out handling, retention, and third-party sharing settings before enabling follow-ups, broadcasts, calendar sync, Slack, CRM, or payment integrations.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: reference/scripts/start-webhook.sh:22

Finding

Public ngrok tunnel may expose the project directory and plaintext credentials

Content

View full analysis

/tmp/ngrok_whatsapp.log & NGROK_PID=$! sleep 3 # Get ngrok URL NGROK_URL=$(curl -s http://127.0.0.1:4040/api/tunnels | python3 -c "import sys,json; print(json.load(sys.stdin)['tunnels'][0]['public_url'])") ``` The associated setup instructions place credentials in the project directory: ```bash cd ~/.openclaw/skills/whatsapp-business-ai npm install pip install -r requirements.txt ``` ```env WHATSAPP_PHONE_NUMBER_ID=your_phone_number_id WHATSAPP_ACCESS_TOKEN=your_permanent_token WHATSAPP_VERIFY_TOKEN=your_webhook_verify_token WHATSAPP_BUSINESS_ACCOUNT_ID=your_business_account_id BUSINESS_HOURS_TIMEZONE=Africa/Johannesburg DEFAULT_LANGUAGE=en NLP_MODEL_PATH=./models/za_intent_classifier LEAD_DB_PATH=./data/leads.db BOOKING_CALENDAR_ID=your_google_calendar_id ``` ### Technical Analysis The script checks for `server.js`, but that file is absent from the audited artifact. It therefore falls back to `python3 -m http.server`. Python's basic HTTP server serves files from the process's current working directory unless a separate directory is explicitly supplied. The documented workflow has the operator enter the Skill directory before running its scripts, a ...[truncated 2331 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: reference/config/prompts.yaml:4

Finding

Untrusted WhatsApp messages are directly interpolated into LLM instruction prompts

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared purpose focuses on automating WhatsApp conversations, but the documented behavior also includes exposing a local webhook endpoint through ngrok and performing infrastructure registration with Meta. That mismatch can mislead users about the true attack surface, especially the fact that the skill makes a local service publicly reachable and depends on internet-exposed webhook handling.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · reference/scripts/start-webhook.sh (reported line 46)May include surrounding context.

sh

sleep 3

# Get ngrok URL
NGROK_URL=$(curl -s http://127.0.0.1:4040/api/tunnels | python3 -c "import sys,json; print(json.load(sys.stdin)['tunnels'][0]['public_url'])")

echo ""
echo "============================================"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README advertises automated WhatsApp replies plus integrations and outbound webhooks to third-party services such as calendars, payments, CRM, and Slack, but does not warn that customer message content and identifiers may be transmitted externally. This omission is dangerous because users may unknowingly route personal or sensitive customer data to multiple processors, increasing exposure, compliance risk, and the chance of accidental over-sharing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README promotes automatic lead logging, a built-in CRM, and CSV/JSON export of customer data without any notice about sensitive data handling, retention, access control, or operator responsibilities. In a WhatsApp business assistant context, this is risky because operators may process names, phone numbers, booking details, and potentially health-related or other sensitive customer information without understanding the privacy and compliance implications.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill clearly requires shell-capable operations such as running installers, starting webhook scripts, invoking curl, and configuring external tooling, yet it declares no explicit tool scope or permissions. This weakens reviewability and containment because operators cannot easily see that the skill needs command execution and network-facing setup before enabling it.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The skill instructs users to place long-lived WhatsApp credentials in a persistent .env file under the skill directory. Persistent local storage of API tokens increases the blast radius of host compromise, accidental backup exposure, or overly permissive file access, especially because the same skill also stores lead data and conversation logs.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

3. Configure environment

Create ~/.openclaw/skills/whatsapp-business-ai/.env:

env

WHATSAPP_PHONE_NUMBER_ID=your_phone_number_id

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The skill transmits sensitive configuration material to an external service during webhook registration, including an access token in an authorization header and a verify token in request data. External transmission is expected for WhatsApp integration, but it is still security-relevant because compromise of logs, shell history, or misconfigured environments could leak credentials tied to business messaging infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

./scripts/start-webhook.sh

Register webhook with Meta

curl -X POST "https://graph.facebook.com/v18.0/$WHATSAPP_PHONE_NUMBER_ID/subscriptions"
-H "Authorization: Bearer $WHATSAPP_ACCESS_TOKEN"
-d "object=whatsapp_business_account&callback_url=https://your-ngrok-url.ngrok.io/webhook&verify_token=$WHATSAPP_VERIFY_TOKEN"

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill supports scheduled follow-ups and bulk broadcasts, but the description does not clearly warn that it can send outbound messages to customers. This can create spam, consent, and legal exposure if an operator enables the skill without understanding that it performs proactive messaging rather than only responding to inbound chats.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill supports scheduled follow-ups and bulk broadcasts, but the description does not clearly warn that it can send outbound messages to customers. This can create spam, consent, and legal exposure if an operator enables the skill without understanding that it performs proactive messaging rather than only responding to inbound chats.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 263)May include surrounding context.

md

| "Message not allowed" | Sender hasn't opted in | Send template message first |
| Low confidence on intent | Trained on wrong business type | Update `config/business.yaml` |
| Calendar sync fails | Missing Google Calendar scope | Re-auth with `https://www.googleapis.com/auth/calendar` scope |
| Leads not saving | SQLite path not writable | `chmod 755 ./data/` |
| ngrok URL changed | Free ngrok rotates on restart | Use paid plan or static IP |

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The reply-generation rules explicitly require responses to be in 'South African English'. This is a natural-language locale constraint and there is no indication elsewhere in the file that the user can choose a different language or opt in to this locale.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The trigger includes the generic intent "booking" alongside broad inquiry intents, but the manifest does not provide additional constraints or negative examples to distinguish gym booking from other booking contexts. In a multi-skill environment, this can overlap with common booking-related requests and lead to the wrong auto-reply being selected.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The intents "booking" and "reservation" are common, high-level triggers that could match many unrelated scenarios. The manifest does not define limiting context, explicit trigger phrases, or exclusions to ensure this reply activates only for restaurant reservations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The trigger relies on broad intents like "booking" and "appointment" without domain-specific qualifiers. Because the manifest does not specify scope boundaries or exclusion cases, ordinary appointment-related requests could invoke the salon template unintentionally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The intent "general" with only a time-of-day context is extremely broad and could overlap with many everyday messages. There are no explicit constraints or negative examples defining which general interactions should map to this greeting versus other skills.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The aliases for the lead intent include extremely broad phrases such as 'info', 'information', 'tell me more', and 'quote', which can match many normal business conversations and cause incorrect intent routing. In a WhatsApp automation context, this can misclassify customer messages, trigger the wrong workflow, and lead to inappropriate lead capture, follow-up, or data collection behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The general intent uses highly generic aliases like 'hi', 'yes', 'no', 'ok', and 'sure', which are common across nearly all conversations and can override or collide with more meaningful intents. In a conversational business bot, this can break stateful flows by treating confirmations, denials, or follow-up answers as generic chatter instead of booking, complaint, or pricing responses.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The workflow relies on a loose description of an incoming "booking" intent without showing explicit trigger conditions, channel constraints, or authorization checks for when this workflow should start. In a conversational automation context, ambiguous activation can cause users to be routed into booking flows unintentionally, leading to incorrect data collection, calendar actions, or downstream writes to external systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The workflow collects a phone number and propagates booking details into Google Calendar, a database, and Slack escalation messages, but this file contains no notice, consent, or minimization controls around that personal data handling. That creates privacy and compliance risk because users may disclose personal information without understanding it will be stored and shared across multiple external systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The natural-language description emphasizes SA-specific slang, templates, and audience tuning, which can indicate a locale-specific behavior. Because the README presents this as the default behavior without an explicit user choice or a clear region-only limitation, it may conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The prompt explicitly instructs the assistant to 'Use South African English' with no indication that the user can choose another language or locale. This is a natural-language locale policy constraint and should be optional or clearly justified with user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file sets language: "en-ZA", which fixes the skill's language/locale behavior to South African English. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The rule activates solely on is_after_hours: true, without indicating what kinds of messages it should handle or when another after-hours workflow should take precedence. This missing scope detail can make invocation behavior unclear in systems with multiple after-hours responses.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.