whatsapp biz responder

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:27 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent WhatsApp support responder, but it gives broad customer-data handling and owner command powers without enough authorization, privacy, or retention controls.

Review before installing. Use a dedicated authenticated owner channel or sender allowlist for all owner commands, require confirmation for template, fee, ticket, and pause/resume changes, add a customer privacy notice, and avoid storing or forwarding raw customer phone numbers and full conversations unless necessary.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:191
• Finding: Privileged Owner Commands Lack Sender Authentication and Authorization## Vulnerability Details **File Location**: `SKILL.md`, lines 191–199 **Vulnerability Type**: Missing authorization for administrative commands **Risk Level**: Medium ### Vulnerable Code ```markdown ## Commands (for the business owner) - **"open tickets"** — List all unresolved customer queries - **"resolve ticket #[id]"** — Mark a ticket as resolved - **"message stats"** — Today's volume, categories breakdown, response rate - **"add template [category] [message]"** — Update an auto-response template - **"pause responder"** — Temporarily stop auto-responses (owner handles manually) - **"resume responder"** — Re-enable auto-responses - **"set fees [text]"** — Update the fees information used in price responses ``` ### Technical Analysis The Skill defines privacy-sensitive and state-changing administrative commands but does not instruct the agent to authenticate the sender or verify that the command arrived through a dedicated administrative channel. Matching natural-language command text is not an adequate authorization boundary because customer messages are untrusted input processed by the same responder. If these commands are recognized solely by their text, an arbitrary customer may be interpreted as the business owner. The available operations include reading unresolved tickets and message statistics, changing persistent response templates and pricing information, resolving tickets, and pausing or resuming the responder. The template-update operation is particularly sensitive because it may persist attacker-controlled content that is subsequently sent to other customers. The `open tickets` and `message stats` operations may expose customer or business information, depending on the details returned by the implementation. ### Attack Path 1. An attacker obtains the public WhatsApp number used by the responder. 2. The attacker submits a message containing an administrative phrase such as `open tickets`, `pause r ...[truncated 1317 chars]
• Remediation: ## Remediation Suggestions 1. Route administrative commands through a dedicated owner-only channel that is separate from customer webhook processing. 2. Before executing any privileged command, normalize and verify the sender identifier against an explicit allowlist of authorized owner phone numbers or authenticated account IDs. 3. Treat `ownerPhone` and `escalateToPhone` as routing configuration only; do not assume that possession of a displayed phone number proves identity. 4. Reject administrative command phrases received through customer-facing message flows, even when their text exactly matches a supported command. 5. Apply command-specific authorization and least privilege. Read-only statistics, ticket access, template modification, and responder-state changes should be independently controlled. 6. Require explicit confirmation for high-impact operations such as pausing the responder, changing templates or fees, and resolving tickets. 7. Validate template categories, constrain template length and content, and prevent attacker-controlled links or deceptive instructions from being persisted without review. 8. Record an audit log containing the authenticated administrator identity, command, timestamp, affected object, and result. 9. Avoid returning customer phone numbers, full conversations, or other personal information unless the authenticated administrator specifically requires it. 10. Add negative tests proving that identical command text from a customer number is rejected and produces no state change or information disclosure.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation

Content

1. Create a Meta Business Account at business.facebook.com
2. Add a WhatsApp Business Account and register your phone number
3. Generate a permanent access token in Meta Developer settings
4. Set `WABA_ACCESS_TOKEN` and `WABA_PHONE_NUMBER_ID` in OpenClaw config
5. Configure your webhook URL to point to your OpenClaw gateway
6. Fill in your business profile in the skill config

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill is designed to automatically process customer messages and explicitly forward full conversations, names, phone numbers, and message contents to the business owner, but it provides no privacy notice, consent flow, or data-sharing warning. This creates a real privacy and compliance risk because customers may disclose personal or sensitive information without understanding that it will be stored, escalated, and shared beyond the immediate chat flow.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The escalation workflow instructs the agent to forward the full customer conversation along with customer name, phone number, timestamp, and category to the owner. This is an unnecessary expansion of data exposure and increases the risk of privacy violations, oversharing of sensitive content, and insecure handling if the owner's messaging channel is less protected.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The ticket memory format stores customer phone numbers, categories, timestamps, and case status directly in agent memory, creating persistent storage of personally identifiable information without any mention of retention limits, encryption, or access control. If memory is exposed or reused across contexts, customer data could be leaked or mishandled.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill forces Hindi/Hinglish responses based on keyword detection without confirming user preference, which can lead to misclassification, misunderstanding, or exclusion of users who used mixed-language terms unintentionally. While this is more of a safety and quality issue than a classic security flaw, it can still cause inappropriate communications and mishandling of customer interactions.

Static analysis

No suspicious patterns detected.