SEA WhatsApp Business Bot

AI-powered WhatsApp auto-responder for MY/SG SMEs. Bilingual BM/EN or CN/EN. Handles appointments, FAQ, orders.

Security Scan

The skill's billing requirement (SKILLPAY_API_KEY) fits the stated pricing model, but the published instructions promise a full WhatsApp auto-responder while the included code implements only a payment gate — this mismatch and a missing shared billing implementation merit caution.

Purpose & Capability

The description promises an AI WhatsApp responder (language detection, intent classification, reply generation). The SKILL.md provides runtime instructions for those behaviors, but the included src/index.ts only implements a billing endpoint (charges a user) and does not perform message processing. Requiring a SKILLPAY_API_KEY is coherent with the declared $0.03 per call pricing, but the actual runtime capability is split between: (a) an external worker that authorizes payment (provided by the included code), and (b) the agent itself following SKILL.md heuristics to build replies. This split is plausible but not explicitly documented.

Instruction Scope

SKILL.md instructs agents to POST to a specific worker URL to authorize payment, then locally perform language detection, intent classification, response generation, and return JSON. The instructions do not ask for extra environment variables or local file reads. However, the skill's prose implies the skill 'handles' appointments/orders, which could be misread as server-side behavior; in reality the server code only performs billing authorization.

Install Mechanism

No install spec is present (instruction-only), which is low risk. There is a wrangler.toml and a small src/index.ts, but no downloads or extract steps. The source imports ../../shared/billing which is not included in the package — this missing dependency is a packaging/visibility issue rather than an explicit install risk.

Credentials

Only SKILLPAY_API_KEY is required, which aligns with the billing/payment behavior. However, because the implementation imports a shared billing module (not provided), it's unclear what that module does with the API key (e.g., which external endpoints are called, what privileges are required). The single env var itself is proportionate, but its usage is opaque without the shared module code.

Persistence & Privilege

The skill does not request always:true, does not declare system config paths, and does not try to persist or modify other skills. Autonomous invocation is allowed by default but is not combined with broad privileges here.

What to consider before installing

Key things to consider before installing: - This skill charges $0.03 per call via SkillPay and requires SKILLPAY_API_KEY — that key will allow the skill to request payments on your behalf. Only provide it if you trust the payment provider and the skill owner. - The included server code only implements a billing/authorization endpoint; the SKILL.md expects the AI agent itself to do language detection, intent classification, and generate replies. Confirm you understand where message handling runs (client/agent vs server). - The code imports a shared module (../../shared/billing) that is not included. Ask the publisher for the full billing module source and a privacy/security policy describing what endpoints it calls and what data it transmits (e.g., does it send user IDs or message content to external services?). - Verify the worker URL and account (the SKILL.md points to sea-whatsapp-business-bot.swmengappdev.workers.dev and wrangler.toml lists an account_id). If you plan to use this in production, confirm ownership of that domain/account and whether the service is hosted by the publisher. - Limit the SKILLPAY_API_KEY permissions if possible, test in a sandbox, and monitor billing activity. If the publisher cannot produce the missing shared code or a clear privacy policy, treat the skill as higher risk and avoid installing it.

Smart auto-responder for Southeast Asian SMEs on WhatsApp.

How to Use This Skill

Step 1: Charge billing

POST to the skill endpoint to authorize payment:

POST https://sea-whatsapp-business-bot.swmengappdev.workers.dev/respond
Content-Type: application/json

{"user_id": "<user_id>"}

If successful, you'll receive {"success": true, "data": {"charged": true}}. If payment fails, you'll receive a payment_url to share with the user.

Step 2: Detect customer language

Use these heuristics to detect the incoming message language:

• Chinese (zh): More than 30% of characters are CJK (Unicode range \u4e00-\u9fff)
• Bahasa Malaysia (ms): Contains words like: saya, nak, boleh, berapa, bila, mana, encik, puan, terima kasih
• English (en): Default if none of the above match

Step 3: Classify intent

Classify the customer's message into one of these intents:

• greeting: Hello, hi, selamat, etc.
• appointment: Wants to book/reschedule/cancel an appointment
• faq: Asking a question that matches business FAQ
• order_status: Checking on an order or delivery
• escalate: Angry, frustrated, or requesting to speak to a human
• general: Everything else

Step 4: Generate response

Using the business configuration provided, generate an appropriate response:

Business config structure:

{
  "name": "Business Name",
  "hours": "9am-6pm Mon-Sat",
  "services": ["Service 1", "Service 2"],
  "faq": [
    {"question": "Common question?", "answer": "Standard answer"}
  ],
  "languages": ["en", "ms"],
  "timezone": "Asia/Kuala_Lumpur"
}

Response guidelines:

• Always respond in the customer's detected language
• Be friendly, professional, and concise
• For FAQ matches, use the provided answers but adapt to the conversation
• For appointments, confirm details and suggest next steps
• For escalation, acknowledge the frustration and offer to connect to a human
• For greetings, respond warmly and offer help
• Keep responses under 160 characters when possible (WhatsApp best practice)

Conversation history: If provided, use previous messages for context continuity.

Step 5: Determine action

Based on the intent, suggest an action:

• book_appointment — when the customer wants to schedule something
• check_order — when asking about order/delivery status
• transfer_to_human — when escalation is needed or the bot can't help
• null — no action needed (greeting, FAQ answered, general chat)

Output Format

Return the response as JSON:

{
  "reply": "Hi! Selamat datang. How can I help you today?",
  "intent": "greeting",
  "action": null,
  "language": "en"
}

Pricing

$0.03 USDT per call via SkillPay.me