whatsapp-automation-v2
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs the user to configure a third-party Model Context Protocol (MCP) server hosted at
https://rube.app/mcp(associated with Composio) to enable the WhatsApp tool functionality. - [INDIRECT_PROMPT_INJECTION]: The skill handles and transmits message content and template parameters that may originate from untrusted sources, creating a surface for indirect prompt injection.
- Ingestion points: Untrusted data can enter the agent context via message bodies in
WHATSAPP_SEND_MESSAGEandWHATSAPP_SEND_REPLY, as well as via variable components inWHATSAPP_SEND_TEMPLATE_MESSAGE. - Boundary markers: The workflow does not specify the use of delimiters (e.g., XML tags or triple backticks) or provide instructions to the agent to ignore embedded commands within the message payloads.
- Capability inventory: The skill enables network-based tool calls to the WhatsApp Business API for sending text, media, and contact information.
- Sanitization: There are no explicit instructions for sanitizing, escaping, or validating external content before it is processed by the WhatsApp messaging tools.
Audit Metadata