Security audit

Whatsapp Msg Manager Free

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent WhatsApp messaging helper, but it asks users to enable a broad external connector and can send irreversible messages with inconsistent confirmation safeguards.

Review before installing. Only proceed if you trust the SkillHub connector package and are comfortable granting OAuth-backed WhatsApp access through a generic connector. Pin or verify the connector where possible, restrict available tools to WhatsApp-only operations, and require explicit approval of the exact recipient and message body before every send.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:164
Finding: Unpinned Executable Connector Dependency
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:165
Finding: Generic Connector Plugin Is Granted Access Beyond the WhatsApp-Only Scope
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 411)May include surrounding context.
md
- 本Skill通过连接器服务自动管理OAuth令牌,无需手动配置API Key - WhatsApp Business API凭证由连接器服务安全存储并自动注入 - 如需直接调用WhatsApp Cloud API,需在Meta开发者平台获取Access Token ### 可用性分类

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger section says to use the skill whenever 'API integration, interface connection, Webhook configuration, or system connection' is needed, which is a very broad class of common technical tasks rather than a narrow WhatsApp-specific invocation condition. It does not define specific trigger phrases, scope boundaries, or negative examples beyond a generic statement that out-of-scope needs are excluded.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill claims that all write operations require user confirmation, but the documented send flow still allows direct execution of connector_call_tool with no enforced confirmation gate. In an agent setting, this can mislead the model or operator into sending WhatsApp messages immediately, creating risk of unauthorized outbound messaging, spam, privacy incidents, or accidental customer contact.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The FAQ asserts a built-in preview confirmation mechanism for all sends, but elsewhere the skill demonstrates direct sending without preview. This inconsistency is dangerous because agents may trust the claim and perform a write action assuming a safeguard exists when it is only advisory documentation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The configuration example sets default_language: "zh_CN", which imposes a specific locale in the skill's natural-language documentation without offering user choice or opt-in. Under the policy, locale constraints should either be optional, user-selectable, or clearly justified as region-specific.
Content: No source excerpt is available for this finding.