ClawHub
Back to skill

Security audit

papi

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed WhatsApp/PAPI integration; it sends messages through an external service but does not show hidden execution, persistence, or deceptive behavior.

Install only if you intend to let the agent send WhatsApp messages through your PAPI account. Keep the PAPI API key private, verify recipient JIDs before sending, obtain appropriate recipient consent, and avoid sending sensitive content unless you accept that message content, media URLs, recipient identifiers, and webhook data will pass through PAPI/WhatsApp infrastructure.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README explicitly promotes sending WhatsApp messages, voice notes, media, polls, documents, contacts, and receiving webhooks through a third-party cloud service, but it does not warn users that potentially sensitive user content and metadata will leave the local agent environment. In an agent-skill context, this omission is security-relevant because operators may enable the skill without understanding the privacy, consent, and data-handling implications of forwarding user communications to an external provider.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

text
4. **Run Connection Doctor Diagnostic**:
   ```bash
   curl -s "https://api.papi.api.br/api/instances/${PAPI_INSTANCE_ID}/status" \
     -H "x-api-key: ${PAPI_API_KEY}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 74)May include surrounding context.

text
4. **Run Connection Doctor Diagnostic**:
   ```bash
   curl -s "https://api.papi.api.br/api/instances/${PAPI_INSTANCE_ID}/status" \
     -H "x-api-key: ${PAPI_API_KEY}"

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language description, setup instructions, and usage examples are presented only in Portuguese, which effectively forces a specific language for users. The policy allows locale constraints only when they are explicitly justified or when users are given a language/locale choice, neither of which is present here.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

🩺 Autodiagnóstico de Conectividade (Doctor)

bash
curl -s "${PAPI_BASE_URL}/api/instances/${PAPI_INSTANCE_ID}/status" \
  -H "x-api-key: ${PAPI_API_KEY}"

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file documents API calls that send outbound messages to a recipient JID, which can affect user data/privacy because phone-number-based identifiers are included and messages are transmitted to end users. The document provides concrete payload examples but does not include any caution about obtaining recipient consent, verifying the target number, or avoiding unintended sends.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

These sections continue to document payloads that send interactive content to a jid, including product and poll content, but do not mention privacy or delivery implications. For markdown files, omission of warnings about behaviors that affect user data or external recipients is in scope for this rule.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:30