whatsapp-business
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows security best practices for handling sensitive API tokens. It retrieves credentials from environment variables provided by the platform connection and includes logic to explicitly redact the token from error messages before they are logged or returned to the user.
- [SAFE]: Network communication is restricted to the official Meta Graph API (graph.facebook.com). This is a well-known and expected service for the skill's stated purpose of sending WhatsApp messages.
- [SAFE]: Input validation is robust. The script uses specific regular expressions to validate phone numbers (E.164 format), template names, and language codes, preventing injection attacks in those fields.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data through a components file used to populate template variables. The skill mitigates risk by parsing the input as structured JSON and using it strictly within the payload of a structured API request. There is no evidence of unsafe interpolation of this data into shell commands or other sensitive execution contexts.
Audit Metadata