Security audit
Security checks for vulnerabilities and agentic risk
This skill transparently converts a user-selected image and sends it as a WhatsApp sticker through a user-controlled local bridge.
Install only if you trust and control the WhatsApp bridge and authenticated session. Keep the bridge on localhost or otherwise secured, confirm the recipient chat ID before sending, and do not use private images or credentials you would not want passed through that bridge and WhatsApp account.
This code sends a sticker generated from a user-supplied local file to the configured WhatsApp bridge via an HTTP POST request. While the behavior is part of the script's purpose, there is no visible confirmation prompt or user-facing disclosure before transmission, and the code does not warn that local image content will be sent onward to WhatsApp infrastructure.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
On Ubuntu or Debian:
sudo apt update
sudo apt install ffmpeg
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
On Ubuntu or Debian:
sudo apt update
sudo apt install ffmpeg
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
On Ubuntu or Debian:
sudo apt update
sudo apt install ffmpeg
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
On Ubuntu or Debian:
sudo apt update
sudo apt install ffmpeg
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
On Ubuntu or Debian:
sudo apt update
sudo apt install ffmpeg
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
On Ubuntu or Debian:
sudo apt update
sudo apt install ffmpeg
Multiple user-facing error and usage strings are written only in Indonesian, such as the invalid-response message at L040, usage text at L055, and status/error output through L147. This forces a specific language for user interaction without any opt-in or documented regional justification, which matches the language/locale policy violation criteria.
The script's natural-language strings, including usage help and all error/success messages, are written only in Indonesian. For a general-purpose utility, this enforces a specific language without any visible user opt-in or locale selection mechanism, which matches the language/locale policy violation criteria.
The script's natural-language output, usage guidance, and error messages are written in Indonesian throughout, with no option for the user to select another language. This can violate language or locale policy where skills must not force a specific language without user opt-in.
Detected: suspicious.dangerous_exec