Security audit

Whatsapp Msg

Security checks across malware telemetry and agentic risk

Overview

This WhatsApp skill is mostly transparent about its purpose, but it enables broad bulk messaging and persistent chat collection with insufficient scoping and safeguards.

Review before installing. Only use this skill with WhatsApp accounts and contacts you are authorized to manage, prefer dry runs and small recipient lists, avoid all-chat backfills unless legally required, disable media auto-download and webhooks unless explicitly needed, and store exported chats, contacts, and event logs with clear retention and access controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The documented input/output contract describes a generic content-processing skill rather than a tightly scoped WhatsApp tool, which can cause an agent to invoke the skill for unrelated tasks. In a skill that exposes read/exec/write and messaging/archive capabilities, this ambiguity increases the chance of unintended execution paths, misuse, or overbroad handling of user data.

Vague Triggers

High

Confidence: 95% confidence
Finding: The invocation description is overly broad and includes generic productivity and automation language, making it likely that an agent may select this skill for many unrelated requests. Because the skill advertises exec, write, bulk messaging, and archival behavior, over-selection can lead to unintended command execution, message sending, or data collection outside the user's real intent.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill gives detailed instructions for bulk messaging and history backfill but does not present prominent consent, privacy, retention, and data-impact warnings at the point of use. This makes misuse easier, including contacting users without authorization and collecting historical chats or media beyond what is necessary for the task.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill promotes broad archival of chats, all-chats backfill, media download, and contact extraction in plain language, which creates a natural path for large-scale collection of sensitive communications data. In a messaging context this is especially dangerous because chats, contacts, and media often contain personal, business-confidential, or regulated information, and the examples encourage expansive collection rather than least privilege.

Ssd 3

High

Confidence: 97% confidence
Finding: The continuous sync instructions direct the agent to capture ongoing message streams, write event logs, auto-download media, and optionally forward events to an external webhook. This creates a persistent exfiltration channel for live communications and metadata, and the risk is amplified by the real-time, continuous nature of the collection and external forwarding.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.