whatsapp-triage

Pass

Audited by Gen Agent Trust Hub on Aug 22, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The setup process involves downloading the whatsapp-chat-exporter tool from PyPI and a specific decryption helper from a public GitHub repository. These tools are required for the primary functionality of exporting encrypted backups.
  • [COMMAND_EXECUTION]: The diagnostic script wa_doctor.py and the setup guide computer-prep.md use shell commands and subprocess calls to verify the local environment, such as checking Python and pip versions and validating file presence. These operations are restricted to environment validation.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from WhatsApp transcripts. It implements defensive layers by using a dedicated script (wa_digest.py) to create a structured and size-limited JSON digest, and specifies strict rules in SKILL.md to prevent the raw data from entering the agent's context directly.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 22, 2026, 11:47 PM
Security Audit — agent-trust-hub — whatsapp-triage