wacli
Warn
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the 'wacli' binary from a third-party GitHub repository (github.com/steipete/wacli) using Homebrew or the Go compiler. This introduces a dependency on external code that is not from a verified or trusted organization.\n- [COMMAND_EXECUTION]: The skill executes multiple shell commands to interact with the WhatsApp CLI, including 'wacli auth', 'wacli messages search', and 'wacli send'. This provides the agent with shell access to a specialized communication tool.\n- [DATA_EXFILTRATION]: The tool includes a file-sending capability ('wacli send file') which allows the agent to read arbitrary local files and transmit them to external WhatsApp accounts. This presents a risk of sensitive data being exfiltrated from the user's environment if the agent is misdirected.\n- [PROMPT_INJECTION]: The skill processes untrusted external data by searching and reading WhatsApp messages. This exposes the agent to indirect prompt injection, where an attacker could send a message containing instructions that the agent might inadvertently execute when processing the chat history.\n
- Ingestion points: WhatsApp chat lists and message search results retrieved via 'wacli chats list' and 'wacli messages search'.\n
- Boundary markers: None; there are no instructions to the agent to distinguish between message content and system instructions.\n
- Capability inventory: Sending text and files via 'wacli send', and syncing history.\n
- Sanitization: The skill does not define any validation or sanitization steps for the message data it retrieves.
Audit Metadata