ClawHub
Back to skill

Security audit

jj

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently enables WhatsApp sending and history search through wacli, with user confirmation required before sending.

Install only if you trust the wacli upstream source and are comfortable granting it access to your WhatsApp account and local ~/.wacli store. Confirm recipients and message text carefully before allowing sends, especially for files or groups.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:4
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

yaml
metadata: {"clawdbot":{"emoji":"📱","requires":{"bins":["wacli"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/wacli","bins":["wacli"],"label":"Install wacli (brew)"},{"id":"go","kind":"go","module":"github.com/steipete/wacli/cmd/wacli@latest","bins":["wacli"],"label":"Install wacli (go)"}]}}

Technical Analysis

The Go installation source uses the mutable version selector @latest, and the Homebrew installation references a third-party tap without specifying a reviewed version or integrity verification mechanism. Consequently, the dependency installed in the future may differ from the version that was reviewed during this audit.

This creates a supply-chain risk: compromise of the upstream repository, package publication process, maintainer account, release artifact, or Homebrew tap could cause users to install altered software without any corresponding change to this Skill. No evidence establishes that the current upstream package is malicious; the vulnerability is the absence of version pinning and artifact verification.

Attack Path

  1. An attacker compromises an upstream maintainer account, repository, release process, Go module source, or Homebrew tap.
  2. The attacker publishes a malicious release or changes the installation metadata or source selected by @latest.
  3. A user installs wacli through one of the installation methods declared by the Skill.
  4. The unverified dependency is installed and subsequently executed with the user's operating-system privileges.
  5. When the user authenticates or invokes the CLI, the compromised program may access available WhatsApp authentication state, synchronized history, recipient information, and files supplied for transmission.

Impact Assessment

A compromised dependency ...[truncated 613 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace github.com/steipete/wacli/cmd/wacli@latest with a specific, reviewed semantic version or immutable commit digest.
  2. Pin the Homebrew installation to a reviewed release where supported, or provide an installation method using a versioned release artifact.
  3. Publish expected SHA-256 checksums for downloaded artifacts and verify them before installation.
  4. Prefer cryptographically signed releases and document signature verification using a trusted maintainer key.
  5. Use automated dependency monitoring to identify newly disclosed vulnerabilities, but require review before updating the pinned version.
  6. Document the exact upstream repository and trusted release channel so users can detect dependency-confusion or repository-substitution attempts.
  7. Run the CLI with least privilege and restrict access to ~/.wacli, because that directory may contain sensitive account and synchronized-history data.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.