Security audit

whatsappVoiceOpenSkill

Security checks across malware telemetry and agentic risk

Overview

This skill mostly does WhatsApp voice transcription as advertised, but it should be reviewed because it automatically processes private voice files, logs full transcripts, and uses a shell command path that is not safely scoped.

Install only after review or patching. Run the listener only for trusted WhatsApp senders, remove or gate raw transcript logging, protect and rotate logs, replace the shell-string execSync call with argument-safe execution, and add explicit confirmations before enabling any handler that changes devices, accounts, files, or public outputs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill advertises and demonstrates capabilities that require network access and likely environment/configuration access, but it declares no permissions. This creates a transparency and trust problem: operators may deploy it without realizing it can fetch external data, access local media paths, or rely on hidden configuration, which increases the chance of unsafe execution in a privileged agent environment.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documented behavior overstates safe, bounded functionality while also implying additional operational actions such as smart-home/IoT control and external weather fetches, and it claims WhatsApp/TTS features that are not actually implemented. This mismatch is dangerous because users may trust the skill in more sensitive environments than warranted, wire it to real-world control handlers, or overlook hidden external dependencies and data flows.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: This example file extends a WhatsApp voice-message processing skill into a general command-and-control surface for smart-home devices, drones, reminders, and music playback. Even though it is presented as sample code, it encourages developers to wire sensitive real-world actions directly to voice intents, which broadens the attack surface well beyond transcription and messaging and can lead to unintended device control if integrated without strong authorization and confirmation checks.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The drone intent advertises support for launch, fly, and land commands in a WhatsApp voice workflow despite no clear business need in the stated skill purpose. Mapping natural-language voice input to safety-sensitive drone operations is dangerous because misclassification, spoofed messages, or unauthorized users could trigger physical-world actions.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: This handler imports an external drone SDK and initializes a drone object from within the voice intent path, showing a concrete integration point for physical device interaction. In the context of a WhatsApp voice processor, this creates a high-risk bridge from remotely supplied audio/text input to external hardware APIs, increasing the chance of unauthorized control or unsafe actions if extended beyond status reads.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The smart-home example retrieves a device and toggles it directly from a handler tied to parsed voice commands. In a messaging/voice interface, this is risky because transcription errors, ambiguous phrasing, replayed messages, or unauthorized senders could cause real device state changes without adequate user verification.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation promotes an auto-listener that continuously monitors inbound WhatsApp voice messages, but it does not warn users that this may capture and process sensitive personal audio and transcripts. In a voice-messaging context, missing privacy and consent warnings can lead to unsafe deployment, unexpected collection of personal data, and improper handling of sensitive content.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The integration examples show sending generated responses and handling processed voice content over WhatsApp without warning that user-derived content may be transmitted to external services or other parties. Because the skill transcribes voice notes and generates responses from that content, omitting disclosure of outbound data flow increases the risk of privacy violations, accidental sharing of sensitive information, and non-compliant integrations.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The auto-listener documentation describes continuous monitoring of an inbound media directory every 5 seconds without warning users that voice files will be automatically detected and processed. In a messaging context, silent background monitoring can capture sensitive personal or business audio unexpectedly, raising privacy and compliance risks.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill promotes transcription, language detection, intent analysis, and response generation on WhatsApp voice content but omits a privacy warning about processing potentially sensitive communications. Because voice notes may contain personal data, credentials, or regulated information, failing to disclose analysis and downstream handling materially increases privacy and data-governance risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The setup guide instructs operators to run an auto-listener that continuously watches an inbound WhatsApp media directory and processes voice notes, but it provides no warning about consent, retention, logging, or handling of potentially sensitive voice data. In a voice-messaging context, this omission can lead to silent processing of personal communications and unsafe deployment practices, especially because users may not realize their audio is being transcribed and acted upon automatically.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The examples show reading WhatsApp voice content, transcribing it, deriving intent, and sending generated responses, but they omit any warning about secure handling of user data, transcript sensitivity, or response leakage. Because the skill is specifically designed for conversational processing of user voice messages, developers may copy these examples into production without adding consent checks, data protection, or safeguards around message content.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The daemon logs full voice transcripts and generated responses to stdout, which can expose sensitive personal data, commands, or account-related information contained in private WhatsApp voice notes. In real deployments, console output is often collected by process managers, container logs, CI systems, or centralized logging platforms, extending retention and access far beyond the intended operator.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The code writes raw voice-note audio to a predictable temporary file on disk, which creates a privacy and data-retention risk if the host is multi-user, backups capture /tmp, or cleanup fails. In a WhatsApp voice-processing context, this may expose sensitive user conversations and metadata beyond the time needed for processing.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The application logs the full transcribed message text verbatim, which can leak sensitive personal or operational information into logs that are often centrally aggregated, retained, and accessible to operators. Because this skill handles private WhatsApp voice notes, the context makes plaintext transcript logging particularly risky.

Unpinned Dependencies

Low

Category: Supply Chain
Content: openai-whisper>=20231117 soundfile>=0.12.1 numpy>=1.21.0
Confidence: 96% confidence
Finding: openai-whisper>=20231117

Unpinned Dependencies

Low

Category: Supply Chain
Content: openai-whisper>=20231117 soundfile>=0.12.1 numpy>=1.21.0
Confidence: 96% confidence
Finding: soundfile>=0.12.1

Unpinned Dependencies

Low

Category: Supply Chain
Content: openai-whisper>=20231117 soundfile>=0.12.1 numpy>=1.21.0
Confidence: 97% confidence
Finding: numpy>=1.21.0

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/voice-processor.js:39

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/voice-processor.js:195