whatsapp-business
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to handle WhatsApp conversations, messages, and templates, which are external data sources that could contain malicious instructions.
- Ingestion points: The skill reads incoming message bodies and template configurations from the WhatsApp Business API via the Maton gateway.
- Boundary markers: The instructions lack explicit boundary markers or directions to the agent to treat incoming message content as untrusted data.
- Capability inventory: The skill utilizes Python and JavaScript snippets to perform network requests (
urllib.request,requests,fetch), write to the API, and manage OAuth connections. - Sanitization: No sanitization or escaping of external content is specified before the agent processes or responds to it.
- [DATA_EXFILTRATION]: The skill requires the use of a sensitive environment variable (
MATON_API_KEY) and transmits it to thematon.aiinfrastructure (gateway.maton.ai,ctrl.maton.ai). These are non-whitelisted external domains. - [COMMAND_EXECUTION]: The documentation provides multiple examples instructing the agent to execute complex Python scripts using shell heredocs (
python <<'EOF'). These scripts utilize standard libraries to perform network operations and process JSON data.
Audit Metadata