Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to execute the
@useclawlink/clipackage vianpxfrom the npm registry. This is a standard method for utilizing the vendor's own command-line tools. - [COMMAND_EXECUTION]: The skill operates entirely through shell commands (
npx @useclawlink/cli) to log in, connect services, and execute WhatsApp actions. This requires the agent to have shell execution capabilities. - [CREDENTIALS_UNSAFE]: The skill documentation notes that authentication credentials are stored locally at
~/.clawlink/credentials.jsonafter the login process. While this involves sensitive data storage, it follows standard CLI credential management practices. - [DATA_EXFILTRATION]: The skill connects to the
claw-link.devhosted service to manage WhatsApp OAuth tokens. Data processed by the skill (messages, templates) will flow through this third-party infrastructure.
Audit Metadata