Whats 1.0.0

Send WhatsApp messages to other people or search/sync WhatsApp history via the wacli CLI (not for normal user chats).

Security Scan

The skill is internally consistent: it wraps the wacli WhatsApp CLI, requests the wacli binary (installable via a brew formula or Go module), and its instructions stay within the stated purpose, but be aware it requires QR auth and local storage of WhatsApp credentials which grant access to messages and sending.

Purpose & Capability

Name/description match the required binary and commands: the skill only needs the wacli CLI to send messages, search/sync history, and the declared install options (homebrew formula or Go module) are appropriate for that purpose. Note: _meta.json ownerId/slug differ from registry metadata (minor metadata inconsistency to verify).

Instruction Scope

SKILL.md restricts use to explicit user requests and lists concrete wacli commands (auth, sync, send, search, backfill). It references the local store (~/.wacli) and recommends --json for parsing. This is expected for a CLI that holds WhatsApp auth/history, but the agent will gain access to message-sending when running these commands, so follow-the-user-confirmation safeguards in SKILL.md should be enforced.

Install Mechanism

Install options are a homebrew formula (steipete/tap/wacli) and a Go module (github.com/steipete/wacli/cmd/wacli). Both are standard, traceable install mechanisms (no arbitrary URL downloads or archive extraction).

Credentials

No environment variables or external credentials are requested by the skill, which is proportional. However, wacli itself performs QR auth and stores credentials/data under ~/.wacli; running the CLI grants access to account messages and the ability to send messages, which is expected but high-sensitivity — users should be aware.

Persistence & Privilege

always is false and the skill does not request persistent platform-level privileges or modify other skills. Autonomous invocation is allowed (platform default); consider requiring explicit user confirmation before any send actions (SKILL.md already recommends this).

Assessment

This skill is a straightforward wrapper for the wacli CLI and appears coherent. Before installing: 1) Confirm you trust the wacli upstream (review the homebrew formula and the GitHub module source if you can). 2) Understand that wacli requires QR-based auth and will store credentials and message history in ~/.wacli — anyone or any process that can run the CLI can access/send messages for that account. 3) Ensure the agent follows the SKILL.md safety steps (explicit recipient + message + confirmation) or restrict autonomous invocation for sending operations. 4) Note the small metadata mismatch in the included _meta.json (owner/slug); consider verifying the publisher identity if provenance matters.

wacli

Use wacli only when the user explicitly asks you to message someone else on WhatsApp or when they ask to sync/search WhatsApp history. Do NOT use wacli for normal user chats; Clawdbot routes WhatsApp conversations automatically. If the user is chatting with you on WhatsApp, you should not reach for this tool unless they ask you to contact a third party.

Safety

• Require explicit recipient + message text.
• Confirm recipient + message before sending.
• If anything is ambiguous, ask a clarifying question.

Auth + sync

• wacli auth (QR login + initial sync)
• wacli sync --follow (continuous sync)
• wacli doctor

Find chats + messages

• wacli chats list --limit 20 --query "name or number"
• wacli messages search "query" --limit 20 --chat <jid>
• wacli messages search "invoice" --after 2025-01-01 --before 2025-12-31

History backfill

• wacli history backfill --chat <jid> --requests 2 --count 50

Send

• Text: wacli send text --to "[phone]" --message "Hello! Are you free at 3pm?"
• Group: wacli send text --to "[e-mail]" --message "Running 5 min late."
• File: wacli send file --to "[phone]" --file /path/agenda.pdf --caption "Agenda"

Notes

• Store dir: ~/.wacli (override with --store).
• Use --json for machine-readable output when parsing.
• Backfill requires your phone online; results are best-effort.
• WhatsApp CLI is not needed for routine user chats; it’s for messaging other people.
• JIDs: direct chats look like <number>@s.whatsapp.net; groups look like <id>@g.us (use wacli chats list to find).