MH wacli

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:48 PM UTC
• Version: 1.0.0

Overview

The skill matches its WhatsApp CLI purpose, but it needs review because it can sync and persist private WhatsApp history and installs an unpinned third-party CLI.

Install only if you are comfortable letting a third-party WhatsApp CLI authenticate, sync, search, and locally store WhatsApp data. Use the narrowest chat/date scope possible, consider an isolated --store path, avoid continuous sync unless needed, and verify the upstream wacli package before installing because this skill does not pin a reviewed version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Third-Party wacli Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–23
Vulnerability Type: Unpinned third-party dependency from mutable remote sources
Risk Level: Medium

Complete Code Snippet:

yaml

"install":
  [
    {
      "id": "brew",
      "kind": "brew",
      "formula": "steipete/tap/wacli",
      "bins": ["wacli"],
      "label": "Install wacli (brew)",
    },
    {
      "id": "go",
      "kind": "go",
      "module": "github.com/steipete/wacli/cmd/wacli@latest",
      "bins": ["wacli"],
      "label": "Install wacli (go)",
    },
  ],

Technical Analysis

The installation configuration obtains wacli from third-party GitHub and Homebrew namespaces without pinning it to an immutable, reviewed artifact. The Go installation explicitly uses the mutable @latest selector. The Homebrew formula is likewise not constrained to a reviewed version, commit, checksum, or signature in the Skill configuration.

As a result, the code installed in the future may differ from the code available when this Skill was audited. An attacker who compromises the upstream repository, release process, maintainer account, or Homebrew tap could distribute modified executable code through these trusted installation paths.

Attack Path

1. An attacker compromises the upstream GitHub repository, release infrastructure, maintainer credentials, or Homebrew tap.
2. The attacker publishes a malicious release or changes the artifact selected by the mutable installation reference.
3. A user or agent installs wacli through the Skill's Go or Homebrew installation path.
4. The package manager resolves and installs the attacker-controlled artifact without verification against a version and integrity value approved during review.
5. The malicious binary executes with the privileges of the user running wacli.
6. During authentication, synchronization, history searches, backfills, or message sending, th ...[truncated 725 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with a specific, reviewed semantic version or immutable commit identifier.
2. Pin the Homebrew installation to a reviewed release rather than implicitly accepting future formula changes.
3. Record and verify cryptographic checksums for distributed binaries or source archives.
4. Prefer signed releases and verify signatures against a documented, trusted maintainer key.
5. Use dependency lockfiles or reproducible-build controls where supported.
6. Re-audit the dependency before updating the pinned version or commit.
7. Install and execute the tool with least privilege, and restrict access to ~/.wacli because it may contain sensitive WhatsApp data and session material.
8. Where feasible, retrieve dependencies through an organization-controlled registry or mirror that admits only reviewed artifacts.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly supports WhatsApp history sync, continuous follow mode, search, and backfill, but does not clearly warn that these actions can ingest and retain sensitive private communications locally. In an agent setting, this omission increases the chance of over-collection or unintended persistence of personal data in ~/.wacli, especially when users may not realize the privacy implications of sync and search operations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.