Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

whatsapp-monitor

v0.0.1

Monitor specified WhatsApp chats for keywords in real time and batch export matched messages to Feishu multi-dimensional tables with optional alerts.

0· 109·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for mrhanson/whatsapp-monitor.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "whatsapp-monitor" (mrhanson/whatsapp-monitor) from ClawHub.
Skill page: https://clawhub.ai/mrhanson/whatsapp-monitor
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install whatsapp-monitor

ClawHub CLI

Package manager switcher

npx clawhub@latest install whatsapp-monitor
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name/description (WhatsApp → Feishu monitoring) aligns with the included scripts (whatsapp_client.py, feishu_client.py, monitor.py, message_processor.py, etc.). However, the skill metadata declares no required credentials or env vars while the runtime expects Feishu credentials (app_id/app_secret/table tokens) and an OpenClaw WhatsApp channel/device pairing. Expectation: credentials are required for operation, but they are only requested via local config files, not via declared env vars.
!
Instruction Scope
Runtime instructions explicitly direct the user/agent to pair WhatsApp Web, read or create local config files, store Feishu App ID/Secret and table tokens in config/feishu-settings.json, and persist matched messages under data/. The instructions also reference multiple lookup locations (skill dir, env-specified dir, user home), and offer optional alert channels (email/SMS/webhooks). Storing secrets in plain JSON and searching user home without enforcing safe permission practices is scope-creep that increases exposure beyond the stated monitoring task.
Install Mechanism
No remote binary downloads or archive extraction are used. install_deps.sh and run scripts install Python packages via pip from PyPI and run bundled tests. This is standard for Python projects; the install mechanism is proportional to the task.
!
Credentials
The code expects sensitive credentials (Feishu app_id/app_secret/table tokens and optionally a tenant_access_token) but the skill metadata lists no required environment variables or primary credential. Instead secrets are placed into config/feishu-settings.json. That mismatch (no declared required creds vs. actual runtime secrets) and the default behavior of writing configs into the skill or user-home paths (and the lack of enforced secure permissions) is disproportionate and raises accidental-exposure risk.
Persistence & Privilege
The skill does not request 'always: true' and does not modify other skills or system-wide settings; it creates local config/data/log directories and writes files under the skill directory. Autonomous invocation is allowed by default (normal for skills) but not by itself a reason to classify as malicious.
What to consider before installing
Things to consider before installing or running this skill: - Credentials handling: The skill expects Feishu credentials (app_id, app_secret, table tokens) but asks you to place them in config/feishu-settings.json (plain JSON), which may be stored under the skill directory or your home directory. Avoid committing that file to git; set secure file permissions and prefer using a secret store or environment variables if you can. - Inspect whatsapp_client.py and omitted files: The WhatsApp client interacts with WhatsApp Web and may automate a browser or rely on an OpenClaw channel; review those files for any network endpoints or unexpected outbound connections beyond Feishu’s API (open.feishu.cn). - Principle of least privilege: Create a Feishu app/token with only the table permissions you need, rotate tokens after testing, and restrict IPs or tenant access if possible. - Test in isolation: Run in a sandbox or non-production account first. The test scripts attempt to write configs and data under the skill directory; confirm file locations and permissions before adding real credentials. - Legal/privacy: Monitoring WhatsApp conversations may capture private or sensitive data. Ensure you have consent and comply with local laws and company policies before monitoring chats. - Deployment hygiene: The skill’s metadata does not declare required env vars; if you deploy this inside OpenClaw, explicitly configure env paths and secret storage in OpenClaw rather than leaving secrets in repo files. Consider adding .gitignore entries for config/feishu-settings.json or move secrets to environment variables or a secret manager. - If you are not comfortable auditing the network and whatsapp_client implementation, treat this skill as higher risk and avoid installing it in privileged environments.

Like a lobster shell, security has layers — review code before you run it.

latestvk9746fy7ndh9h5zq5yvjxr6zpn83eww8
109downloads
0stars
1versions
Updated 1mo ago
v0.0.1
MIT-0

WhatsApp Message Monitor Skill

Overview

This skill enables automated monitoring of WhatsApp conversations, filtering for specific keywords, and batch exporting matching messages to Feishu (Lark) multi-dimensional tables.

Core Features

  • Target Monitoring: Configure WhatsApp contacts or groups to monitor
  • Keyword Filtering: Define keywords or patterns to watch for
  • Batch Collection: Accumulate messages until threshold is reached
  • Scheduled Export: Periodically push collected messages to Feishu tables
  • Real-time Alerts: Optional immediate notification for high-priority keywords

快速开始

1. 前提条件

使用此技能前,请确保:

  • WhatsApp 访问权限:个人或商业账户
  • 飞书/Lark 账户:具备 API 访问权限
  • 飞书多维表格应用:已安装和配置
  • OpenClaw WhatsApp 渠道:已配置并配对设备

2. OpenClaw 集成步骤

  1. 配置 WhatsApp 渠道

    # 在 OpenClaw 中设置 WhatsApp 渠道
    openclaw channels enable whatsapp
    
  2. 配对 WhatsApp 设备

    • 打开浏览器访问 WhatsApp Web (web.whatsapp.com)
    • 扫描二维码配对设备
    • 确保设备状态显示为“已连接”
  3. 安装技能依赖

    cd ~/whatsapp-monitor   # 或你的克隆目录,例如 /opt/whatsapp-monitor
    pip install -r requirements.txt
    
  4. 配置监控目标

    # 编辑配置文件
    python scripts/setup.py
    
  5. 配置飞书集成

    • 获取飞书应用凭证 (App ID, App Secret)
    • 创建多维表格并获取 Table Token
    • 更新 config/feishu-settings.json

3. 首次运行

测试配置:

python scripts/monitor.py --test-config

启动监控:

python scripts/monitor.py --start

查看状态:

python scripts/monitor.py --status

2. Configuration Files

This skill uses two main configuration files:

  • config/whatsapp-targets.json - Define WhatsApp contacts/groups to monitor
  • config/feishu-settings.json - Configure Feishu API and table settings

Configuration

WhatsApp Targets

Create config/whatsapp-targets.json:

{
  "version": "1.0",
  "targets": [
    {
      "name": "Project Team Chat",
      "type": "group",  // "contact" or "group"
      "identifier": "1234567890-1234567890@g.us",  // WhatsApp group ID
      "enabled": true,
      "keywords": ["urgent", "deadline", "blocker", "issue"],
      "priority": "high"
    },
    {
      "name": "Client Support",
      "type": "contact",
      "identifier": "+1234567890@c.us",  // WhatsApp contact ID
      "enabled": true,
      "keywords": ["complaint", "escalation", "critical", "outage"],
      "priority": "medium"
    }
  ],
  "monitoring": {
    "scan_interval_minutes": 5,
    "batch_size": 10,
    "max_age_hours": 24,
    "alert_on_high_priority": true
  }
}

Feishu Settings

Create config/feishu-settings.json:

{
  "feishu": {
    "app_id": "YOUR_APP_ID",
    "app_secret": "YOUR_APP_SECRET",
    "table_app_token": "YOUR_TABLE_APP_TOKEN",
    "table_token": "YOUR_TABLE_TOKEN"
  },
  "table": {
    "name": "WhatsApp Monitor Log",
    "fields": [
      {"name": "timestamp", "type": "datetime"},
      {"name": "source", "type": "text"},
      {"name": "sender", "type": "text"},
      {"name": "message", "type": "text"},
      {"name": "keyword_matched", "type": "text"},
      {"name": "priority", "type": "text"}
    ]
  },
  "export": {
    "batch_threshold": 10,
    "schedule": "every 30 minutes",
    "retry_on_failure": true,
    "max_retries": 3
  }
}

使用工作流

设置阶段

  1. 初始化配置 - 设置监控目标和飞书凭证

    python scripts/setup.py
    
  2. 测试连接 - 验证 WhatsApp 和飞书 API 连接

    python scripts/monitor.py --test-config
    
  3. 启动监控 - 开始扫描配置的聊天

    python scripts/monitor.py --start
    

OpenClaw Skill 集成

在 OpenClaw 中使用此技能:

# 加载技能(路径改为本机 Linux 上的技能目录)
openclaw skills load ~/whatsapp-monitor

# 或直接调用技能函数
openclaw skills run whatsapp-monitor --start

定时任务设置

通过 OpenClaw cron 设置定时监控:

# 创建定时任务
schedule:
  kind: "cron"
  expr: "*/5 * * * *"  # 每5分钟运行一次
payload:
  kind: "agentTurn"
  message: "运行 WhatsApp 消息监控"
  sessionTarget: "isolated"

实时通知配置

配置实时告警(当匹配到高优先级关键词时):

  1. config/whatsapp-targets.json 中设置:
{
  "monitoring": {
    "alert_on_high_priority": true
  }
}
  1. 配置通知渠道(可选):
    • 飞书机器人消息
    • 电子邮件通知
    • 短信告警

Monitoring Phase

The system will:

  1. Periodically check configured WhatsApp chats
  2. Filter messages for keyword matches
  3. Store matching messages locally
  4. Export to Feishu when batch threshold is reached or on schedule

Export Phase

When ready to export, the system will:

  1. Format collected messages according to table schema
  2. Push to Feishu multi-dimensional table
  3. Clear local cache after successful export
  4. Log export status and any errors

Tools and Scripts

Core Monitoring Script

See scripts/monitor.py for the main monitoring logic.

Configuration Management

See scripts/config.py for handling configuration files.

Feishu API Integration

See scripts/feishu_client.py for Feishu table operations.

WhatsApp Web Automation

See scripts/whatsapp_web.py for WhatsApp Web interaction.

Advanced Features

Custom Filters

Beyond simple keywords, you can implement:

  • Regular expression patterns
  • Sentiment analysis
  • Time-based rules
  • Sender-specific filters

Alerting Options

Configure additional alert channels:

  • Email notifications
  • Slack/Teams messages
  • SMS alerts
  • Push notifications

Data Enrichment

Enhance collected messages with:

  • Sentiment scores
  • Entity extraction
  • Topic classification
  • Translation services

Troubleshooting

Common Issues

  1. WhatsApp Web Connection - Ensure browser automation is working
  2. Feishu API Permissions - Verify app has correct table permissions
  3. Keyword Matching - Check for case sensitivity and special characters

Monitoring Status

Check monitoring logs in logs/whatsapp-monitor.log for operational details and errors.

Integration Examples

Combine with Other Skills

This skill can be combined with:

  • Calendar Integration - Trigger calendar events based on messages
  • Task Management - Create tasks from important messages
  • CRM Systems - Update customer records from support chats

Automated Reporting

Set up automated reports:

  • Daily summary reports
  • Weekly keyword trend analysis
  • Monthly activity reports

Security Considerations

  • Store sensitive credentials securely (use environment variables)
  • Implement rate limiting for API calls
  • Regularly audit access logs
  • Consider data retention policies

Performance Optimization

For high-volume monitoring:

  • Implement message deduplication
  • Use batch API calls for Feishu
  • Optimize keyword matching algorithms
  • Consider distributed monitoring for multiple accounts

Maintenance

Regular maintenance tasks:

  • Update keyword lists periodically
  • Review export success rates
  • Monitor API rate limits
  • Backup configuration and logs

References

For detailed API documentation and additional resources, see:

Quick Commands

Start Monitoring

python scripts/monitor.py --start

Force Export

python scripts/monitor.py --export

View Status

python scripts/monitor.py --status

Test Configuration

python scripts/monitor.py --test-config

Support

For assistance or feature requests, refer to the troubleshooting section or contact the skill maintainer.

Comments

Loading comments...