WhatsApp Image Send

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:11 AM UTC
• Version: 1.0.1

Overview

The skill does what it says, but it uses unsafe shell-command templates to download, copy, send, and delete user-controlled files through WhatsApp.

Review this skill carefully before installing. It is not deceptive, but it should be tightened to use structured APIs or safely escaped argument arrays, generate private temporary filenames, validate URLs and recipients, and explicitly confirm the recipient, file, caption, and retention of the workspace copy before sending anything to WhatsApp.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:13

Finding

Command and Option Injection Through Unvalidated Shell Placeholders

Content

View full analysis

cp /tmp/ ~/.openclaw/workspace/ message --channel whatsapp --target --filePath /home/seekey/.openclaw/workspace/ --message "" rm /tmp/ ``` ### Technical Analysis The workflow instructs the Agent to interpolate a filename, URL, phone number, and caption directly into shell commands. It does not require structured process arguments, shell escaping, strict validation, or termination of command options with `--`. If these commands are assembled as shell text, metacharacters in an attacker-controlled value can alter command structure and execute additional commands. The quoted caption remains unsafe when interpolated into a shell command because embedded quotes, command substitutions, or other shell syntax can escape or affect the intended argument. Values beginning with `-` can also be interpreted as command-line options, while path separators in the filename can alter the files being accessed. The vulnerability affects all four workflow stages: downloading, copying, sending, and cleanup. ### Attack Path 1. An attacker asks the Agent to send media and supplies a crafted filename, URL, phone number, or caption. 2. The Agent substitutes the supplied value into one of the documented shell command templates. 3. The shell interprets attacker-controlled metacharacters or option prefixes rather than treating the entire value as inert data. 4. An injected command executes with the privileges of the Agent process, or a manipulated option changes the behavior of `curl`, `cp`, `message`, or `rm`. 5. The attacker can consequently access or modify files available to the Agent, cause unintended network requests, delete files, or redirect WhatsApp delivery. ### Impact Assessment Successful exploitation can execute arbi ...[truncated 507 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:11

Finding

Predictable and Attacker-Controlled Temporary File Handling

Content

View full analysis

# Copy to workspace cp /tmp/ ~/.openclaw/workspace/ # Cleanup rm /tmp/ ``` ### Technical Analysis The workflow uses a predictable, caller-influenced path directly under the shared `/tmp` directory. It does not atomically create a private temporary file, check for symbolic links, enforce restrictive permissions, or verify that the resolved path remains inside an Agent-owned temporary directory. On systems where another local process can create entries in `/tmp`, an attacker may prepare a symbolic link or replace the file between workflow stages. The download, copy, and removal operations can then act on a different file than the Agent intended. The same workflow also lacks download size limits, timeouts, URL-scheme restrictions, and content validation, allowing untrusted downloads to consume storage or introduce unexpected content. ### Attack Path 1. The temporary filename is known, predictable, or influenced through the media request. 2. A local attacker creates `/tmp/` as a symbolic link to a file accessible to the Agent, or replaces the path between the download, copy, and cleanup stages. 3. `curl` writes through the path, `cp` copies content from the substituted target into the workspace, or `rm` operates on the manipulated directory entry. 4. The copied content may subsequently be transmitted through WhatsApp, while a write operation may alter an unintended file. 5. Alternatively, an attacker supplies an unrestricted URL serving an oversized response, causing excessive disk, bandwidth, or processing consumption. ### Impact Assessment The impact depends on the Agent account's filesystem permissions. Exploitation may overwrite accessible files, copy unintended readable data into the messag ...[truncated 368 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: whatsapp-image-send
description: Send images/files to WhatsApp. Use when user wants to send an image, photo, screenshot, video, audio or document via WhatsApp. Workflow: (1) Download to /tmp, (2) Copy to ~/.openclaw/workspace/, (3) Send via message tool with filePath, (4) Delete /tmp file. Required because WhatsApp plugin only allows workspace paths for media.
---

# WhatsApp Image Send

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The cleanup step uses a shell command with a placeholder filename and no validation or quoting. If the filename is attacker-controlled or contains shell metacharacters, path traversal, or option-like prefixes, the command could delete unintended files or be abused in command execution chains.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

4. Cleanup: Delete temp file

   bash

   rm /tmp/<filename>
   

Notes

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to download a remote file, copy it into a persistent workspace, send it to an external messaging channel, and delete the temporary source without any user-facing warning or confirmation requirements. This is dangerous because it creates a quiet data-exfiltration workflow and may cause users to overlook persistence and transmission of potentially sensitive files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.