Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly does what it says, but it needs review because its documentation adds an undeclared Feishu/Lark document-writing path and its WhatsApp recipient limits are not actually enforced by the code.
Install only if you are comfortable with a local WhatsApp CLI sending messages from your logged-in account. Treat the Feishu/Lark documentation as unresolved scope drift unless the publisher removes it or formally documents and permission-scopes that feature. Also verify the intended WhatsApp recipient yourself, because the bundled allowlist is not enforced by this script.
if shutil.which("wu") is None:
return "skipped", "wacli `wu` not installed (npm i -g @ibrahimwithi/wu-cli)"
try:
result = subprocess.run(
["wu", "send", recipient_jid, message],
capture_output=True, text=True, check=True,
)No suspicious patterns detected.