WhatsApp Business Automation by WhatsAble

v1.0.2

Full three-phase agent skills suite for Notifyer by WhatsAble. Phase 1 (setup-notifyer): account signup, login, WhatsApp connection status, subscription plan...

⭐ 0· 28·0 current·0 all-time

by@whatsable

Security Scan

Capability signals

CryptoCan make purchasesRequires OAuth tokenRequires sensitive credentials

These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.

VirusTotal

Benign

View report →

OpenClaw

Suspicious

medium confidence

ℹ

Purpose & Capability

The name/description and the included Node.js scripts align: the files implement account setup, templates, bots, broadcasts, webhooks and chat operations against a Notifyer API. However the registry metadata (as presented at the top) claims no required environment variables or primary credential, whereas the SKILL.md and included clawhub.json repeatedly require NOTIFYER_API_BASE_URL and NOTIFYER_API_TOKEN. That mismatch between advertised registry requirements and the actual instructions/files is unexpected and should be clarified.

Instruction Scope

The SKILL.md instructs agents and users to set NOTIFYER_API_BASE_URL and NOTIFYER_API_TOKEN and to run many node scripts (login.js, doctor.js, create-broadcast.js, etc.). Those instructions are functionally within scope for a Notifyer integration. However a pre-scan flag indicates a 'system-prompt-override' prompt-injection pattern was detected in SKILL.md content — this suggests parts of the skill documentation may attempt to instruct an agent to change its behavior or system prompt, which is out-of-scope and dangerous. Also the published registry fields omit the env vars required by the runtime instructions; that inconsistency widens the scope-concern.

ℹ

Install Mechanism

There is no install spec (no network downloads, no brew/npm installs), and the repo bundles many self-contained Node.js scripts that use only built-in APIs. This is lower install risk than fetching remote archives, but the package includes 100+ script files that would be written to disk when the skill is added — review them before executing. The mismatch between 'instruction-only' and the actual included code files is also noteworthy but not inherently malicious.

Credentials

The required environment access asserted by the SKILL.md — NOTIFYER_API_BASE_URL and NOTIFYER_API_TOKEN (JWT) and an optional NOTIFYER_CHAT_ORIGIN — is proportional to the described API integration. That said, the registry metadata claims no required envs/primary credential; this contradiction is suspicious and could lead to unexpected token usage. The scripts include a get-api-key.js to fetch a developer API key (used for Make/Zapier/n8n), which is expected for this product, but you should treat any retrieval or storage of developer API keys carefully. No unrelated credentials were requested in the scripts themselves.

✓

Persistence & Privilege

The skill is not marked always:true and does not request elevated or persistent platform privileges. Autonomous invocation (disable-model-invocation=false) is the platform default and not a unique risk here. There is no evidence the skill modifies other skills' configs or requests system-wide settings.

Scan Findings in Context

[system-prompt-override] unexpected: A prompt-injection pattern was detected in SKILL.md. For an integration script package, documentation should not contain instructions that attempt to override an agent's system prompt or tell the agent to ignore platform safeguards. Inspect SKILL.md for any 'do not follow previous instructions' or 'override system prompt' style text and remove or ignore such sections before enabling autonomous behavior.

What to consider before installing

What to check before installing or running this skill: - Confirm provenance: SKILL.md and clawhub.json reference a GitHub repo and api.insightssystem.com, but the registry metadata you were shown listed no homepage/source. Locate and inspect the upstream GitHub repository (https://github.com/Whatsable/whatsapp-business-agent-skills) and ensure it is the official source and has recent, sensible commits. - Inspect code before execution: the package bundles many Node.js scripts. Open and review scripts/lib/notifyer-api.js and any code that calls loadConfig/requestJson to ensure they only read the documented env vars and do not read unrelated files (e.g., ~/.ssh, ~/.bash_history) or attempt to exfiltrate data to unexpected domains. - Validate environment requirements: the SKILL.md requires NOTIFYER_API_BASE_URL (must be https://api.insightssystem.com per docs) and NOTIFYER_API_TOKEN (JWT). The registry metadata omitted these — do not trust the registry omission. Only provide the token if you trust the code and service. Prefer creating a scoped/test account/token when possible. - Search SKILL.md for prompt-injection content: because a 'system-prompt-override' pattern was flagged, remove or ignore any instructions in SKILL.md that try to alter agent/system prompts or tell the agent to ignore earlier instructions. - Least privilege & isolation: run scripts in an isolated environment (throwaway account, container, or VM) first. Do not export production-wide tokens into global shell startup files until you confirm behavior. - Developer API key caution: get-api-key.js can retrieve a developer API key for integrations — treat that key like any secret. If a script outputs or persists that key, ensure it is stored securely and not uploaded to third-party services. - If you need help: ask for a focused code review of specific files (e.g., notifyer-api.js, login.js, get-api-key.js) if you are not comfortable reading the code yourself. Bottom line: the code appears functionally consistent with a Notifyer integration, but the metadata inconsistencies and the prompt-injection signal make this package suspicious until you verify the upstream repository and review the SKILL.md and the key library files.

✗

skills/automate-notifyer/scripts/lib/notifyer-api.js:31