Security audit

thoughtful

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-aligned, but it repeatedly processes private WhatsApp conversations and sends derived content through LLM and Telegram workflows with privacy and persistence concerns users should review.

Install only if you are comfortable with private WhatsApp-derived content being summarized by an LLM workflow and delivered to a specific Telegram destination on a schedule. Confirm the exact Telegram topic, how to disable the cron jobs, where local JSON and prompt files are stored, how long they remain, and whether raw chat content can be minimized or deleted after each run.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The README makes a reassuring privacy claim ('all data stored locally, no cloud sync') while elsewhere describing prompt generation for an LLM and Telegram delivery. That combination can mislead users into believing sensitive WhatsApp-derived data never leaves the local machine, when in practice summaries or prompts may be transmitted to third-party services. In a skill centered on private relationship communications, this mismatch materially increases privacy and consent risk.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The skill is framed as a WhatsApp companion but instructs delivery of outputs through Telegram, creating a cross-channel disclosure path for private chat-derived content. Even if intended for user convenience, moving summarized WhatsApp content into another messaging platform expands the trust boundary and can expose sensitive information to a different service, chat, or audience.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: Using `pkill -9 wacli-readonly` is a blunt process-termination command that can kill any matching local process without verifying ownership, state, or necessity. In a scheduled automation context, this can cause denial of service, corrupt client state, interfere with concurrent sessions, and normalize arbitrary process control unrelated to the skill's user-facing purpose.

Context-Inappropriate Capability

Medium

Confidence: 81% confidence
Finding: Persistent cron creation gives the skill ongoing execution beyond an immediate user request, which increases the blast radius of any misconfiguration or unsafe behavior. In this skill, that persistence repeatedly accesses message data and forwards summaries, making any privacy or delivery mistake recurring and harder for users to notice or revoke.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The README describes processing WhatsApp messages into prompts for an LLM and sending summaries via Telegram, but does not prominently warn that intimate, personally identifying, and third-party conversation data may be transmitted off-device. Because the skill handles relationship history, commitments, sentiment, and private chats, users may unknowingly expose highly sensitive communications to external providers, creating substantial confidentiality and consent issues.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill processes highly sensitive private communications and sends prompt/context to an LLM for analysis, but it does not present that as a prominent, explicit user warning where the functionality is described. Users may reasonably assume local-only analysis from the framing, so the omission undermines informed consent and increases privacy risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script retrieves WhatsApp messages and chat metadata and writes them to local JSON files under a persistent work directory without any access controls, minimization, retention policy, or explicit user-facing privacy safeguards. In the context of a relationship-focused assistant, this data is highly sensitive, so local plaintext storage increases the risk of unintended disclosure through other local users, backups, logs, or compromise of the host environment.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script writes a prompt containing recent WhatsApp messages, tasks, and relationship context to a plaintext local file. That creates a secondary copy of sensitive communications on disk, increasing exposure through local compromise, backups, shared machines, logs, or accidental disclosure, especially because there is no consent flow, warning, retention control, or permission hardening visible here.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill explicitly instructs collection and summarization of private WhatsApp conversations and then delivery through Telegram in natural language. That creates a straightforward exfiltration channel where sensitive interpersonal content, commitments, and inferred emotional state can be disclosed outside the original platform and potentially to unintended recipients.

Ssd 3

Medium

Confidence: 97% confidence
Finding: Reading generated prompt/context from chat-derived files and instructing the agent to produce a Telegram-delivered summary establishes a direct natural-language leak path from sensitive source data to an external channel. Because the intermediate prompt may contain raw or richly detailed context, the risk is not just metadata exposure but disclosure of substantive private message content and behavioral inferences.

Ssd 3

Medium

Confidence: 88% confidence
Finding: The prompt explicitly consolidates private WhatsApp conversations, tasks, and relationship information into a single model input, which materially increases the sensitivity and blast radius of the data being processed. In this skill context, that is more dangerous because the application is specifically designed to ingest intimate personal communications, making over-collection, over-sharing with downstream models, and privacy harm more likely if consent, minimization, and secure handling are not enforced.

Static analysis

No suspicious patterns detected.