Security audit

WhatsApp Styler

Security checks across malware telemetry and agentic risk

Overview

This is a WhatsApp text-formatting skill with sloppy extra boilerplate, but the inspected artifact does not contain executable code, persistence, credential collection, or hidden data movement.

Install only if you want an agent to rewrite WhatsApp-bound messages into WhatsApp markup. Treat the exec/API-key/security sections as poor boilerplate rather than required setup, and do not grant this skill shell, network, or credential permissions unless a future version clearly justifies them.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The documentation gives conflicting guidance about whether API keys are required, which can mislead users into enabling external integrations or handling secrets unexpectedly. In a skill that should only format text, ambiguity around secret use increases the risk of accidental credential exposure and unsafe deployment assumptions.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill is presented as a WhatsApp formatting guide, yet it also claims partial exec/command-line capability. This unnecessary expansion of scope can normalize execution privileges for a low-risk task, increasing the chance an agent or user grants shell access where none should be needed.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Introducing command-line execution into a text-formatting skill violates least privilege and creates an unjustified path to code execution. Even without explicit payloads, this broadens the attack surface and could cause an agent framework to authorize dangerous capabilities based on misleading documentation.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The FAQ and security sections discuss command execution, whitelisting, and environment-variable secrets despite the skill's benign stated purpose. This mismatch can desensitize reviewers and users to elevated-risk behavior, making it easier for overprivileged skills to pass as harmless formatting helpers.

Vague Triggers

High

Confidence: 94% confidence
Finding: The trigger keywords are extremely broad and overlap with normal conversation terms such as 'ensure', 'messages', and 'skill'. This can cause unintended activation, leading the agent to apply instructions or policies when the user did not explicitly request this skill.

Vague Triggers

High

Confidence: 93% confidence
Finding: Repeating the same ambiguous trigger list reinforces a high likelihood of accidental invocation. In an agent environment, unclear activation boundaries can let a style-enforcement skill hijack ordinary responses or interfere with unrelated tasks.

Natural-Language Policy Violations

Medium

Confidence: 80% confidence
Finding: The skill imposes a mandatory formatting/style policy ('strict formatting rules') without indicating user opt-in or fallback behavior. While not directly enabling code execution, this can override user intent, alter message semantics, and create unsafe automation behavior if applied automatically in unrelated contexts.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.