ClawHub

MH wacli

v1.0.0

Send WhatsApp messages to other people or search/sync WhatsApp history via the wacli CLI (not for normal user chats).

⭐ 0· 1.8k·24 current·25 all-time
by@mohdalhashemi98-hue
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description, required binary, and install methods (brew formula steipete/tap/wacli and Go module github.com/steipete/wacli) align with a CLI-based WhatsApp tool. There are no unrelated env vars, credentials, or config paths requested.
ℹ
Instruction Scope
SKILL.md only instructs the agent to run wacli commands (auth, sync, search, send, backfill) and to require explicit recipient+message confirmations. This stays within the stated purpose. Note: using those commands implies access to WhatsApp messages and writes to the tool's store directory (~/.wacli), so the agent (or the wacli binary) will be able to read/write message history and auth tokens as part of normal operation.
✓
Install Mechanism
Installers are standard: a Homebrew formula and a Go module (both point to the project's name/author). No direct downloads from arbitrary URLs or extracted archives are referenced in the skill metadata. Verify the brew tap and Go module author before installing, but the install mechanism itself is proportionate.
✓
Credentials
The skill declares no environment variables or external credentials, which is consistent with a local CLI-focused tool. There are no requests for unrelated secrets or system-wide config.
ℹ
Persistence & Privilege
always is false and the skill does not request system-wide privileges. The wacli binary will create/use a local store (default ~/.wacli) to hold auth/session data — this is expected but worth noting because it stores sensitive tokens and message history on disk.
Assessment
This skill appears to do what it says: it calls the wacli CLI to send and search WhatsApp messages. Before installing, confirm you trust the wacli project (inspect the Homebrew formula and the Go module repo at github.com/steipete/wacli and the homepage https://wacli.sh). Understand that wacli will store auth/session data and synced message history under ~/.wacli and can read/send messages for the authenticated WhatsApp account. Only grant access if you intend the agent to be able to send messages to third parties and access message history. If you want tighter control, keep the skill disabled unless explicitly invoked and review the CLI’s source code or package recipe for any unexpected network or filesystem actions. Absence of static scan findings only means there were no regex matches — it is not a substitute for reviewing the upstream package and its install scripts.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dnee9778g3061e3cjrk3pyn81tab3

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📱 Clawdis
Binswacli

Install

Install wacli (brew)
Bins: wacli
brew install steipete/tap/wacli
Install wacli (go)
Bins: wacli
go install github.com/steipete/wacli/cmd/wacli@latest

Comments