ClawHub
Back to skill

Security audit

WhatsApp图片发送-免费版

Security checks across malware telemetry and agentic risk

Overview

This skill mostly describes sending one image through WhatsApp, but its trigger instructions wrongly route unrelated video and audio tasks into a network-sending workflow.

Review before installing. Use this only for explicit requests to send one JPG, PNG, or GIF to a specific WhatsApp recipient. Do not let it handle video, audio, media conversion, dubbing, bulk sending, documents, or ambiguous file-sharing requests. Confirm the exact image, caption, and phone number because the workflow sends them through WhatsApp and may copy files into the platform workspace.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The trigger-condition text tells agents to use this skill for video processing, audio editing, media conversion, and dubbing generation, which is far outside the stated image-sending scope. Overbroad or contradictory routing guidance can cause an agent to invoke this skill in unintended contexts, increasing the chance of inappropriate file handling, data exfiltration to external messaging services, or unsafe command execution paths.

Vague Triggers

High
Confidence
93% confidence
Finding
The trigger section is inconsistent and overly broad, making this skill eligible for tasks unrelated to its declared purpose. In an agentic environment, ambiguous invocation criteria are dangerous because they can route sensitive or unsupported user requests into a skill that performs network transmission and shell-command-based file operations, leading to accidental data leakage or misuse.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill does not clearly warn users that it will transmit user-provided images/files and recipient phone numbers over the network to an external messaging service. This is a meaningful privacy and consent issue because users may unknowingly cause third-party disclosure of personal data, and the skill context makes that risk more serious since WhatsApp delivery is the core behavior.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.