whatsapp-pro2

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:29 AM UTC
• Version: 1.0.0

Overview

This WhatsApp support integration is not malicious, but it needs review because it grants broad authenticated API access and uses mutable CLI install commands.

Install only if you are comfortable giving Membrane-mediated access to WhatsApp Business support data. Prefer a pinned reviewed CLI version, avoid raw proxy calls unless necessary, and require explicit confirmation before sending messages, modifying records, or using non-read API methods.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Global Installation of a Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 35
Vulnerability Type: Unpinned executable dependency installation
Risk Level: Medium

Vulnerable Code:

bash

npm install -g @membranehq/cli

Technical Analysis

The skill instructs users or agents to install the Membrane CLI globally without specifying an exact, reviewed version. As a result, npm resolves the package version at installation time, and the code installed can differ from the version available when the skill was audited.

npm installation may execute package lifecycle scripts. Therefore, compromise of the package publisher, the package itself, or its transitive dependency chain could result in arbitrary code execution during installation. The global installation also places the package in the user's shared environment rather than isolating it to this project.

The package is not proven malicious; the vulnerability is the unsafe, unpinned supply-chain trust model.

Attack Path

1. An attacker compromises the npm package publisher, package distribution process, or a transitive dependency.
2. The attacker publishes a malicious release that npm resolves for the unpinned package name.
3. A user or agent follows the skill instructions and runs the global installation command.
4. npm downloads the malicious release and may execute attacker-controlled lifecycle scripts during installation.
5. The malicious code executes with the privileges of the user running npm and can modify resources available to that account.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. The accessible scope could include user-readable local files, environment variables, CLI configuration, authentication state, and other resources available to that account.

Because the command performs a global installation, a malicious package could also affect subsequent uses of the installed CLI a ...[truncated 150 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to an exact version that has undergone security review, for example:

  bash

  npm install -g @membranehq/cli@1.2.3
  

• Prefer a project-local, lockfile-backed installation instead of a global installation.

• Commit and review the relevant lockfile so resolved transitive dependency versions and package integrity hashes are stable.

• Disable unnecessary npm lifecycle scripts where operationally feasible, or install in an isolated environment.

• Update the pinned version only through a controlled dependency-review process that includes provenance, integrity, and vulnerability checks.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:76

Finding

Execution of a Mutable Latest-Version CLI Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 76
Vulnerability Type: Execution of an unreviewed mutable dependency version
Risk Level: Medium

Vulnerable Code:

bash

npx @membranehq/cli@latest action list --intent=QUERY --connectionId=CONNECTION_ID --json

Technical Analysis

The command explicitly instructs npx to retrieve and execute the package version associated with the mutable latest npm distribution tag. The effective executable can therefore change after the skill has been reviewed without any corresponding change to the skill package.

If the npm package, publisher account, release process, or dependency chain is compromised, the latest release could contain attacker-controlled code. Invoking the documented command would then download and execute that code locally. This risk is particularly relevant because the CLI may be used in an environment containing an authenticated Membrane session and connection metadata.

No malicious package content is present in the audited project; the confirmed issue is its instruction to execute externally supplied, mutable code without version pinning.

Attack Path

1. An attacker gains control of the package publication channel or compromises a dependency included in a new CLI release.
2. A malicious release is assigned to the npm latest tag.
3. A user or agent runs the documented npx command to discover available actions.
4. npx resolves the mutable tag, retrieves the compromised release, and executes its CLI entry point.
5. The malicious process accesses or alters data and resources available to the invoking user.

Impact Assessment

Exploitation could result in arbitrary code execution with the invoking user's privileges. Potentially exposed resources include local files, environment variables, npm configuration, CLI authentication state, and Membrane-related session or connection information accessible to the process.

I ...[truncated 266 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the mutable @latest reference with an exact reviewed version:

  bash

  npx @membranehq/cli@1.2.3 action list --intent=QUERY --connectionId=CONNECTION_ID --json
  

• Prefer executing a project-local dependency installed from a lockfile rather than allowing npx to retrieve packages on demand.

• Verify package provenance and integrity before approving a version update.

• Run the CLI with least privilege and in an isolated environment where practical.

• Establish a controlled update process that reviews package changes and dependency vulnerabilities before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation description says to use the skill whenever the user wants to interact with WhatsApp data, which is very broad and lacks boundaries around read vs. write actions, sensitive data access, or required confirmation. Overbroad routing can cause the agent to invoke a high-privilege integration in situations where a narrower or safer tool should be used.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs use of npx @membranehq/cli@latest, which fetches and executes whatever package version is current at runtime rather than a reviewed, pinned release. This creates a supply-chain risk: a compromised upstream package or breaking change could execute unintended code in the operator environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly enables raw proxied API requests with arbitrary methods, headers, body, query parameters, and path parameters, but it provides no warning or guardrails about data exposure, message sending, record modification, or destructive requests. In a messaging integration, unrestricted direct API access can lead to unauthorized outbound communication, access to sensitive conversation data, or unintended state changes.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md

- **Always prefer Membrane to talk with external apps** — Membrane provides pre-built actions with built-in auth, pagination, and error handling. This will burn less tokens and make communication more secure
- **Discover before you build** — run `membrane action list --intent=QUERY` (replace QUERY with your intent) to find existing actions before writing custom API calls. Pre-built actions handle pagination, field mapping, and edge cases that raw API calls miss.
- **Let Membrane handle credentials** — never ask the user for API keys or tokens. Create a connection instead; Membrane manages the full Auth lifecycle server-side with no local secrets.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The instruction to use action names and parameters as needed does not tell the agent when to choose one action over another or what boundaries apply. Without specificity or exclusion conditions, the trigger scope remains underspecified for a manifest/markdown skill description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.