WhatsApp Image Send

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:11 AM UTC
• Version: 1.0.1

Overview

The skill does what it says, but it uses unsafe shell-command templates to download, copy, send, and delete user-controlled files through WhatsApp.

Review this skill carefully before installing. It is not deceptive, but it should be tightened to use structured APIs or safely escaped argument arrays, generate private temporary filenames, validate URLs and recipients, and explicitly confirm the recipient, file, caption, and retention of the workspace copy before sending anything to WhatsApp.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:13
• Finding: Command and Option Injection Through Unvalidated Shell Placeholders<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13–28 **Vulnerability Type**: Command and option injection **Risk Level**: High ### Vulnerable Code ```bash curl -o /tmp/<filename> <url> cp /tmp/<filename> ~/.openclaw/workspace/ message --channel whatsapp --target <phone> --filePath /home/seekey/.openclaw/workspace/<filename> --message "<caption>" rm /tmp/<filename> ``` ### Technical Analysis The workflow instructs the Agent to interpolate a filename, URL, phone number, and caption directly into shell commands. It does not require structured process arguments, shell escaping, strict validation, or termination of command options with `--`. If these commands are assembled as shell text, metacharacters in an attacker-controlled value can alter command structure and execute additional commands. The quoted caption remains unsafe when interpolated into a shell command because embedded quotes, command substitutions, or other shell syntax can escape or affect the intended argument. Values beginning with `-` can also be interpreted as command-line options, while path separators in the filename can alter the files being accessed. The vulnerability affects all four workflow stages: downloading, copying, sending, and cleanup. ### Attack Path 1. An attacker asks the Agent to send media and supplies a crafted filename, URL, phone number, or caption. 2. The Agent substitutes the supplied value into one of the documented shell command templates. 3. The shell interprets attacker-controlled metacharacters or option prefixes rather than treating the entire value as inert data. 4. An injected command executes with the privileges of the Agent process, or a manipulated option changes the behavior of `curl`, `cp`, `message`, or `rm`. 5. The attacker can consequently access or modify files available to the Agent, cause unintended network requests, delete files, or redirect WhatsApp delivery. ### Impact Assessment Successful exploitation can execute arbi ...[truncated 507 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not construct commands by concatenating user-controlled text into shell strings. 2. Prefer native download, filesystem, and messaging APIs with structured parameters. 3. If a subprocess is necessary, pass an argument array with shell processing disabled. 4. Generate temporary and workspace filenames internally instead of accepting raw filenames from users. 5. Restrict filenames to a conservative allowlist, reject path separators and control characters, and canonicalize paths before use. 6. Validate URLs using a URL parser and permit only required schemes, preferably HTTPS. 7. Validate WhatsApp targets against an explicit international telephone-number format. 8. Treat captions exclusively as data passed through a structured messaging API. 9. Insert `--` before positional filesystem operands where supported to prevent option injection. 10. Verify that all resolved source and destination paths remain inside their intended directories. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:11
• Finding: Predictable and Attacker-Controlled Temporary File Handling<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 11–18 and 26–28 **Vulnerability Type**: Unsafe temporary-file handling **Risk Level**: Medium ### Vulnerable Code ```bash # Download curl -o /tmp/<filename> <url> # Copy to workspace cp /tmp/<filename> ~/.openclaw/workspace/ # Cleanup rm /tmp/<filename> ``` ### Technical Analysis The workflow uses a predictable, caller-influenced path directly under the shared `/tmp` directory. It does not atomically create a private temporary file, check for symbolic links, enforce restrictive permissions, or verify that the resolved path remains inside an Agent-owned temporary directory. On systems where another local process can create entries in `/tmp`, an attacker may prepare a symbolic link or replace the file between workflow stages. The download, copy, and removal operations can then act on a different file than the Agent intended. The same workflow also lacks download size limits, timeouts, URL-scheme restrictions, and content validation, allowing untrusted downloads to consume storage or introduce unexpected content. ### Attack Path 1. The temporary filename is known, predictable, or influenced through the media request. 2. A local attacker creates `/tmp/<filename>` as a symbolic link to a file accessible to the Agent, or replaces the path between the download, copy, and cleanup stages. 3. `curl` writes through the path, `cp` copies content from the substituted target into the workspace, or `rm` operates on the manipulated directory entry. 4. The copied content may subsequently be transmitted through WhatsApp, while a write operation may alter an unintended file. 5. Alternatively, an attacker supplies an unrestricted URL serving an oversized response, causing excessive disk, bandwidth, or processing consumption. ### Impact Assessment The impact depends on the Agent account's filesystem permissions. Exploitation may overwrite accessible files, copy unintended readable data into the messag ...[truncated 368 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create an Agent-owned private temporary directory with restrictive permissions, such as mode `0700`. 2. Generate unpredictable names using a secure temporary-file API or `mktemp`; do not derive temporary paths from user input. 3. Create files atomically with exclusive-create semantics and reject symbolic links. 4. Resolve and validate paths before every file operation to ensure they remain inside the private temporary directory or approved workspace directory. 5. Apply restrictive file permissions and avoid following links when copying or deleting files. 6. Enforce HTTPS where applicable, explicit connection and transfer timeouts, maximum download sizes, and redirect limits. 7. Validate the downloaded content type and file signature against the media type the user requested. 8. Clean up both temporary and workspace copies after delivery when retention is unnecessary, using verified paths rather than caller-provided names. 9. Prefer direct API-based media transfer where possible to avoid shared temporary filesystem paths. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

---
name: whatsapp-image-send
description: Send images/files to WhatsApp. Use when user wants to send an image, photo, screenshot, video, audio or document via WhatsApp. Workflow: (1) Download to /tmp, (2) Copy to ~/.openclaw/workspace/, (3) Send via message tool with filePath, (4) Delete /tmp file. Required because WhatsApp plugin only allows workspace paths for media.
---

# WhatsApp Image Send

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

4. **Cleanup**: Delete temp file
   ```bash
   rm /tmp/<filename>
   ```

## Notes

• Confidence: 89% confidence
• Finding: The cleanup step uses a shell command with a placeholder filename and no validation or quoting. If the filename is attacker-controlled or contains shell metacharacters, path traversal, or option-like prefixes, the command could delete unintended files or be abused in command execution chains.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to download a remote file, copy it into a persistent workspace, send it to an external messaging channel, and delete the temporary source without any user-facing warning or confirmation requirements. This is dangerous because it creates a quiet data-exfiltration workflow and may cause users to overlook persistence and transmission of potentially sensitive files.

Static analysis

No suspicious patterns detected.