The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions in SKILL.md require users to run curl -fsSL https://raw.githubusercontent.com/0xs4m1337/openclaw-whatsapp/main/install.sh | bash. This executes remote code from an untrusted individual's repository with the user's full privileges.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection in scripts/wa-notify-worker.sh. It incorporates untrusted message content and sender names directly into the LLM prompt without sanitization or boundary markers.
Ingestion points: WhatsApp message data (body, name, JID) enters via scripts/wa-notify.sh and is stored in a local queue file.
Boundary markers: None. Untrusted variables like $msg and $history are interpolated into a plain-text prompt template.
Capability inventory: The agent can execute the openclaw-whatsapp send command and any other tools configured in the openclaw environment.
Sanitization: No sanitization or escaping of message content is performed before interpolation.
[COMMAND_EXECUTION]: The scripts/wa-notify-worker.sh script uses timeout 45s openclaw agent to execute commands generated by the AI based on the injected WhatsApp content. This allows a remote attacker to potentially trigger unauthorized agent actions.
[EXTERNAL_DOWNLOADS]: The worker script pipes the output of a local API call (http://localhost:8555/chats/${jid}/messages) directly into a Python interpreter. While intended for JSON parsing, this pattern increases the attack surface if the local API were compromised or manipulated via the jid variable.

openclaw-whatsapp