Security audit

whatsapp-messaging

Security checks across malware telemetry and agentic risk

Overview

This WhatsApp Business skill is mostly purpose-aligned, but it needs review because it enables real outbound messaging while giving inconsistent confirmation and overly broad capability guidance.

Review this skill before installing. It should only be used for clearly requested WhatsApp Business tasks, and every send, media upload, template creation, or template deletion should require a recipient/content preview and explicit user confirmation. Treat the generic API key, file-processing, and command-execution sections as overbroad boilerplate rather than permission to run unrelated actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill repeatedly states that all message-sending write operations require explicit user confirmation, but the examples demonstrate direct execution of message-sending commands without any preview or confirmation gate. In a real agent environment, this inconsistency can cause the model or operator to treat direct send actions as acceptable, increasing the risk of unauthorized outbound messaging to real recipients.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The document says authentication is fully handled by ClawLink and that users do not need to manually supply API tokens, but later instructs users to export an API key environment variable. Conflicting auth guidance can lead users or agents to mishandle secrets, inject unnecessary credentials into the environment, or expose unrelated API keys during troubleshooting or execution.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The manifest and primary documentation present this as a WhatsApp Business messaging skill, but later sections claim generic file processing, API integration, command execution, and information retrieval capabilities unrelated to the declared tool scope. This scope expansion is dangerous because it can mislead an agent into invoking broader local or external actions than the user intended, violating least privilege and increasing the attack surface.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The inline capability text asserts support for file processing and sandboxed command execution even though the described WhatsApp tool inventory does not justify those powers. In an agentic setting, capability overstatement can cause unsafe delegation, where the model believes it is allowed to read/write files or execute commands based solely on this documentation.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The invocation guidance is overly broad, framing the skill as appropriate whenever the user wants general efficiency, automation, batch handling, or workflow optimization. Such expansive routing criteria can cause the agent to select this skill outside its intended WhatsApp messaging scope, increasing the chance of unintended external actions or data disclosure through the connected integration.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.