Security audit
Security checks for vulnerabilities and agentic risk
Overview
The package’s WhatsApp messaging, account linking, and history tools fit its stated purpose and include meaningful user controls.
Link only the intended account, preferably a dedicated number, and keep pairing and chat allowlists restrictive. Protect stored sessions and enable history syncing, plugin message hooks, calls, or approval routing only when needed. This verdict reflects targeted static inspection, not a complete dependency audit.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Endor dependency reachability
Checked Nov 5, 2026 · 10:27 AM UTC
No reachable vulnerabilities reported
Endor dependency scan completed.