Security audit

Notifyer by WhatsAble

Security checks for vulnerabilities and agentic risk

Overview

This Notifyer skill is mostly real automation tooling, but it also ships under-disclosed account, team-admin, credential, conversation, and destructive workspace controls that users should review carefully.

Install only if you intend the agent to have broad Notifyer workspace authority, including team administration, API-key retrieval, customer conversation access, webhook changes, outbound messaging, and destructive broadcast/member operations. Use a least-privilege Notifyer account, avoid passing passwords directly on the command line, review scripts before running them, and treat outputs containing API keys, phone numbers, messages, and recipient CSVs as sensitive.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (37)

Description-Behavior Mismatch

Medium

Confidence: 79% confidence
Finding: The document states the webhooks API group also supports manual phone registration, but that capability is omitted from the manifest-facing description and script inventory. Undocumented capabilities reduce auditability and can conceal higher-risk operations from policy engines or users evaluating what the skill can do.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The file explicitly states that the knowledge-base upload endpoint is a public endpoint with no auth gate. That allows unauthenticated users to upload arbitrary files into the platform's attachment store, creating abuse risk such as storage exhaustion, malicious content hosting, and unauthorized content injection into downstream bot workflows.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The reference explicitly documents that `DELETE /broadcast/{broadcast_id}` performs destructive deletion without a `/get_user` authentication step and relies only on a caller-controlled `Origin` header. Because `Origin` is not a trustworthy authentication mechanism for server-to-server/API calls, an attacker who can guess or enumerate broadcast IDs could delete scheduled broadcasts and cascade-delete recipient data across accounts.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This reference documents team-member administration APIs for a different service/domain than the skill’s stated Notifyer/WhatsAble automation scope. Introducing unrelated account-management capabilities expands the effective privilege surface and could enable unauthorized user creation, modification, password reset, or deletion under the guise of a messaging automation skill.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The file includes create, update, password reset, role change, and delete workflows for team accounts, which are not justified by the manifest’s WhatsApp automation purpose. In agent environments, this mismatch is dangerous because an operator may unknowingly grant the skill access to sensitive identity-management actions unrelated to the requested task.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The documentation points to api.insightssystem.com rather than the manifested Notifyer service, indicating scope confusion or cross-service capability injection. This makes it easier to smuggle access to an unrelated backend into a trusted skill and increases the risk of credential misuse or operator deception.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The reference document exposes a manual phone registration capability that is outside the manifest-described scope of webhook/template/bot/broadcast/analytics operations. Expanding documented capabilities beyond the declared skill boundary increases the risk that an agent or operator invokes sensitive account/device-management actions unexpectedly, especially because this endpoint interacts with external registration flows and logs the result.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: This script adds unauthenticated account-creation capability even though the skill metadata says it should be used only after setup and authenticated connection are complete. That scope expansion is dangerous because it enables identity/account lifecycle actions outside the declared automation boundary, increasing the chance of unauthorized account creation, abuse of third-party infrastructure, or operator confusion about what the skill is permitted to do.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script explicitly documents and implements insecure direct object access by allowing any authenticated user to retrieve any bot record by numeric ID, without verifying ownership or tenant/workspace authorization in the client flow. Because bot records include sensitive configuration such as system prompts, knowledge base text, trigger keywords, and assistant IDs, predictable IDs can enable enumeration and cross-bot data exposure.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This script creates full workspace team member accounts with supplied credentials, which expands the skill's authority beyond the manifest's stated scope of managing messaging automation resources. In an agent setting, this enables unauthorized identity and access management actions, potentially granting persistent access to the Notifyer workspace to attacker-controlled users.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code provisions privileged accounts and allows assignment of roles including Admin, which is a sensitive IAM capability not justified by the described automation purpose. If misused through prompt injection, operator error, or compromised agent workflows, it could create rogue users with broad access to templates, analytics, webhooks, and other tenant resources.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The script adds team-member enumeration capability that is not justified by the skill manifest, expanding access to internal account administration data beyond the stated WhatsApp automation use cases. In an agent-skill context, undocumented identity and role discovery increases the risk of unnecessary data exposure and privilege mapping if the skill is invoked broadly or by mistake.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The code retrieves and outputs names, emails, roles, and labels for all account members, which are sensitive internal identity and authorization details. This information can facilitate internal reconnaissance, targeted phishing, and role-based attack planning, especially because the skill context is focused on messaging automation rather than organization directory management.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This script exposes irreversible workspace user-deletion functionality even though the skill’s declared purpose is WhatsApp automation, templates, analytics, and webhooks. That scope mismatch is dangerous because an agent or user expecting messaging automation could be induced to perform destructive account-administration actions unrelated to the advertised capability.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code performs workspace account administration by listing members and issuing a DELETE request for a selected account, which is outside the stated WhatsApp automation use case. In this context, the hidden administrative capability is especially risky because it enables permanent removal of users using the same API token trusted for routine automation tasks.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script exposes a capability to send ad hoc free-text WhatsApp messages, but the declared skill scope only mentions templates, bots, broadcasts, analytics, and webhook management. This scope mismatch is dangerous because it creates hidden messaging functionality that could be abused for unauthorized outbound contact, policy violations, or user surprise, especially in an automation skill with access to authenticated messaging credentials.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: This script performs team-member administration against authentication endpoints, including role and label changes, which is outside the declared skill scope of WhatsApp automation, campaigns, analytics, and webhooks. That mismatch is dangerous because a user invoking an automation-focused skill could unknowingly grant or alter account access, expanding the skill into identity and privilege management without clear disclosure or justification.

Description-Behavior Mismatch

Critical

Confidence: 99% confidence
Finding: The script supports password resets for team members, but that behavior is not disclosed in the skill description and is far more sensitive than the advertised automation features. Hidden password-reset capability can directly enable account takeover of Notifyer users, especially when exposed through an agent skill that may be trusted for messaging operations rather than identity administration.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The code can rename members, change roles, assign labels, and reset passwords via the auth/user endpoint, allowing direct modification of identities and authorization state. In the context of a skill meant for Notifyer automation, this is especially risky because it introduces powerful account-management actions unrelated to the expected purpose, increasing the chance of privilege abuse or surprising security-sensitive side effects.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The manifest explicitly advertises high-impact capabilities—bulk WhatsApp broadcasts, analytics retrieval, and webhook management—without warning users that the skill can access message metadata, affect external integrations, or trigger large-scale outbound messaging. In this context, the omission increases the risk of unsafe use, privacy surprises, and unintended operational impact because users are not prompted to consider consent, data handling, rate limits, or webhook side effects.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation explicitly instructs users to retrieve the workspace Developer API key and even print it for easy copying, but does not place a prominent warning immediately around that workflow about terminal history, logs, screenshots, or accidental sharing. Because the key is a long-lived credential with no rotate/regenerate endpoint, encouraging casual display materially increases the chance of credential exposure and downstream account misuse.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The file documents an API that can send WhatsApp template messages to arbitrary phone numbers and describes it as usable by external automation tools, but it does not pair that guidance with strong consent, authorization, and privacy-use warnings. In a messaging automation skill, this increases the risk of spam, unauthorized outreach, and mishandling of personal contact data if operators treat the capability as unrestricted.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation normalizes a public upload flow without prominently warning that uploads may be unauthenticated and the returned attachment metadata uses public access. In a skill that handles bot knowledge files, this increases the likelihood that operators expose sensitive documents or rely on an endpoint that can be abused by anyone on the internet.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation describes a destructive endpoint with cascade deletion behavior and even notes the missing `/get_user` check, but it does not present this as a security defect or warn consumers not to use or expose it. This normalizes an unsafe API pattern and increases the chance that agents or developers will invoke a high-risk operation without understanding that it may be unauthorized and can wipe recipient data.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation describes a recipient lookup endpoint marked as 'Public' while returning recipient data based on phone_number and user_id, which are identifiers that may be guessable or obtainable elsewhere. Even if clients usually send Authorization, a public backend configuration can enable unauthorized enumeration or disclosure of recipient PII if server-side access control is not strictly enforced.

Static analysis

Detected: suspicious.env_credential_access, suspicious.secret_argv_exposure

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/delete-scheduled.js:45

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/lib/notifyer-api.js:31

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/lib/notifyer-api.js:31

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/lib/notifyer-api.js:31

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/send-attachment.js:68

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:199