whatsapp-messaging

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:40 AM UTC
• Version: 1.0.0

Overview

The skill mainly matches a WhatsApp Business messaging purpose, but it asks for and documents broader local file, command, and persistent plugin authority than that purpose clearly needs.

Review this before installing in any environment with sensitive files or production WhatsApp access. Require a pinned and trusted ClawLink plugin release, remove or constrain read/exec/write permissions, clarify that WhatsApp uses ClawLink OAuth rather than a generic API_KEY, and keep explicit confirmation for every send, media upload, template creation, or template deletion.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:77

Finding

Unpinned Third-Party Plugin Is Installed and Added to the Agent Allowlist

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 77-79
Vulnerability Type: Supply-chain exposure through an unpinned dependency
Risk Level: High

Vulnerable Code

bash

skill-platform plugins install SkillHub:clawlink-plugin
skill-platform config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
skill-platform gateway restart

Technical Analysis

The installation procedure retrieves SkillHub:clawlink-plugin without specifying an immutable version, commit, package digest, checksum, or signature. It then adds the plugin to the Agent tool allowlist and restarts the gateway.

Consequently, the code that will execute is not fully represented by the audited project. Its behavior may change after this Skill has been reviewed, and there is no documented integrity check that binds installation to a known artifact. Compromise of the package registry, publisher account, package resolution process, or a future package release could introduce attacker-controlled behavior.

This is especially sensitive because the plugin is documented as handling WhatsApp OAuth credentials, account information, outbound messages, media, and template-management operations.

Attack Path

1. An attacker compromises the plugin publisher, distribution source, or package resolution process.
2. The attacker publishes or substitutes a malicious version of SkillHub:clawlink-plugin.
3. A user follows the Skill instructions and runs the unpinned installation command.
4. The configuration command places the installed plugin on the Agent's tool allowlist.
5. The gateway restart activates the plugin in subsequent Agent sessions.
6. The malicious plugin can abuse the permissions and integration data available to it, including intercepting tool calls or manipulating WhatsApp operations.

Impact Assessment

Successful exploitation could provide execution within the plugin's runtime context and access to the integr ...[truncated 312 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the plugin to an immutable, reviewed version or content digest.
• Publish the authoritative repository, package publisher identity, and release provenance.
• Verify a cryptographic signature and checksum before installation.
• Use a lockfile or equivalent mechanism to prevent silent dependency upgrades.
• Review the plugin source and generated package before adding it to the tool allowlist.
• Restrict the plugin to only the WhatsApp API operations required by this Skill.
• Avoid automatic activation after installation; require an explicit administrative review before restarting the gateway.
• Monitor dependency updates and revoke the plugin immediately if its publisher or distribution channel is compromised.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:26

Finding

Skill Requests General Filesystem and Command-Execution Permissions Beyond Its Messaging Scope

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26-29
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Medium

Vulnerable Code

yaml

tools:
- read
- exec
- write

Technical Analysis

The declared purpose of the Skill is to operate WhatsApp Business functionality through dedicated ClawLink tools. Nevertheless, its manifest requests general-purpose filesystem read access, filesystem write access, and command execution.

These broad capabilities are not demonstrated as necessary for listing WhatsApp resources, sending messages, uploading media, or managing templates through the documented proxy interface. Granting them expands the trust boundary from a constrained messaging integration to local host operations.

The document states that command execution occurs in a sandbox, but it does not define the sandbox boundary, filesystem restrictions, command allowlist, environment-variable filtering, or process isolation. A descriptive assertion therefore does not establish an enforceable security control.

Attack Path

1. The Skill is loaded with the declared read, write, and exec capabilities.
2. A malicious or misleading user input, compromised dependency, or instruction-manipulation attempt causes the Agent to invoke a general-purpose tool instead of a narrowly scoped WhatsApp operation.
3. The Agent reads sensitive local files, modifies project or configuration files, or executes an operating-system command.
4. Retrieved data may then be exposed through tool output or transmitted using the Skill's external communication capabilities.
5. Written files or executed commands may alter the local environment beyond the intended WhatsApp task.

Impact Assessment

The excessive permissions may enable access to files available to the Agent process, modification of writable local resources, and command execution within the effective sandbox ...[truncated 249 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the generic read, write, and exec permissions unless each capability is strictly required and documented.
• Replace broad permissions with an explicit allowlist of ClawLink and WhatsApp-specific tools.
• If local file access is required, restrict it to dedicated directories and approved file types.
• If command execution is unavoidable, use fixed commands and structured arguments rather than shell interpolation.
• Enforce operating-system sandboxing, a minimal environment, network restrictions, execution timeouts, and resource limits.
• Require explicit user confirmation for every outbound message, upload, template creation, template deletion, and other state-changing operation.
• Deny access to credentials, home directories, SSH material, environment files, and unrelated project data.
• Add automated policy tests that fail packaging when a communication-only Skill requests unrestricted filesystem or execution capabilities.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The feature summary claims generic file handling and system command execution capabilities unrelated to WhatsApp messaging, indicating scope creep beyond the advertised purpose. In an agent skill, unnecessary capabilities materially increase abuse potential because the skill may be selected for broad tasks and then operate on local files or commands under the guise of a communications tool.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation description is so broad that the skill may be selected for generic productivity, automation, or workflow requests unrelated to WhatsApp. Because this skill also advertises powerful capabilities, over-broad routing language increases the chance of inappropriate invocation and misuse of sensitive permissions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest advertises broad read/exec/write capabilities despite the skill being presented as a WhatsApp messaging integration. Over-broad tool permissions increase the risk that the skill could be invoked in unrelated contexts and used to access files or execute commands beyond its stated purpose, violating least privilege.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill gives conflicting authentication guidance: it says ClawLink handles OAuth and no manual token management is needed, but later instructs users to configure an API key via environment variables. This ambiguity can cause operators to introduce unnecessary secrets into the environment, increasing the chance of credential leakage or misuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Introducing command-execution capability in documentation for a messaging skill normalizes shell execution as part of normal use, even though it is not necessary for the stated function. In agent environments, this can expand the attack surface by encouraging execution paths where user-controlled content may influence commands or operational workflows.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The API key configuration block directly contradicts the earlier claim that WhatsApp access is handled entirely through ClawLink-managed OAuth. In a security-sensitive messaging skill, contradictory auth instructions can lead users to store secrets locally, pass the wrong credentials, or misunderstand the trust boundary between the agent, plugin, and third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The description states '支持中文交互，无需复杂配置即开即用,' which presents Chinese interaction as a built-in default behavior. For organizational language policy, forcing or implying a default language without explicit user choice can be a locale-policy issue, especially since other parts of the file mention both Chinese and English support.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

L347-L348 says '单次发送最多支持10个图片', implying multi-image message support. However, the documented tools in L141-L153 only cover whatsapp_send_media and whatsapp_send_media_by_id for sending a media item, with no batch or gallery-style image send capability described elsewhere in the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.