Thoughtful

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:16 AM UTC
• Version: 1.3.0

Overview

This WhatsApp companion is mostly purpose-aligned, but it handles private chat data with hard-coded Telegram delivery, recurring automation, and durable plaintext storage that users should review carefully.

Review and change the configuration before using this with real WhatsApp data. Confirm exactly which chats are included, remove or replace the hard-coded Telegram chat/topic, understand that message content and relationship inferences may be sent to an LLM, and add retention/deletion and file-permission protections for the local data directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill is marketed as a WhatsApp companion, but the documented workflow sends generated summaries to Telegram, creating a cross-platform data flow that a user may not reasonably expect. This can expose sensitive WhatsApp-derived content to a different messaging platform, channel, or audience than intended, especially with hard-coded destination metadata.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The code persists crm.json, people.json, state.json, and a plaintext last-prompt.txt containing sensitive conversation summaries and behavioral analytics. In a WhatsApp companion context, this materially increases exposure because intimate relationship data, reply patterns, and message snippets remain on disk and can be accessed later by other local processes, backups, or anyone with filesystem access.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README explicitly states that WhatsApp-derived conversation data will be sent to an LLM and only later mentions privacy in general terms, without a clear warning that third-party personal communications may be transmitted for model processing. Because the skill processes relationship data, commitments, sentiment, and message content from other people, users may unintentionally expose sensitive third-party information without informed consent or minimization.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The workflow sends WhatsApp conversation content, relationship inferences, and potentially sensitive personal data to an external LLM for analysis without a prominent warning at the point where this behavior is introduced. Because the tool processes intimate communications and behavioral signals, undisclosed third-party processing materially increases privacy and confidentiality risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The setup instructs the agent to generate and send a WhatsApp authentication QR code image to the user without warning that whoever scans or intercepts it can link and access the WhatsApp session. Authentication artifacts are highly sensitive, and transmitting them over another channel expands the attack surface for account compromise.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script exports recent WhatsApp messages and chat metadata into local JSON files under a persistent working directory without any notice, consent check, retention control, or permission hardening. Because this skill is explicitly designed to remember relationship details, the stored data is highly sensitive; local compromise, shared accounts, backups, or later misuse could expose private conversations and social graph information.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Sensitive CRM and prompt files are written to disk with no consent flow, no warning, and no evident filesystem hardening. Because the data includes personal contacts, message previews, and inferred relationship state, silent persistence in a consumer messaging assistant creates a meaningful privacy and secondary-access risk.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The prompt is built from full direct-message contents, group messages, pending tasks, and CRM signals, then serialized into a reusable plaintext artifact for later LLM use. In this skill context, that is especially dangerous because private WhatsApp conversations and derived social-relationship analytics are concentrated into one easy-to-exfiltrate prompt, amplifying the sensitivity beyond the original chat store.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The code explicitly saves the generated prompt with sensitive conversations to DATA_DIR/context/last-prompt.txt. This creates a durable plaintext cache of highly private communications and inferred personal dynamics, making later theft through local compromise, misconfigured backups, shared accounts, or debugging workflows much easier.

Session Persistence

Medium

• Category: Rogue Agent

Content

- Confirm summary timing (default: 11am daily)
   - Confirm tracking features (sentiment, commitments, etc.)

4. **Create cron jobs**
   - Set up WhatsApp sync cron (10:30 AM, isolated session)
   - Set up daily summary cron (11:00 AM, isolated session)
   - Confirm both are scheduled correctly

• Confidence: 81% confidence
• Finding: Create cron jobs** - Set up WhatsApp sync cron (10:30 AM, isolated session) - Set up daily summary cron (11:00 AM, isolated session) - Confirm both are scheduled correctly 5. **Test run**

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.