wacli-hardened
Warn
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the 'wacli' tool from a third-party GitHub repository (steipete/wacli) via Homebrew or Go. This source is not recognized as a trusted vendor or well-known service in the provided configuration.
- [COMMAND_EXECUTION]: The skill uses a wide range of shell commands to manage WhatsApp data, including authentication, message searching, and history backfilling.
- [DATA_EXFILTRATION]: The skill accesses highly sensitive personal communications and contact metadata stored in '~/.wacli'. Although it contains strong guardrails in SKILL.md and SAFETY.md prohibiting the piping of data to network commands, the agent retains the capability to read and process this sensitive information.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by processing untrusted data from WhatsApp messages. * Ingestion points: Message content is ingested via 'wacli messages search' and 'wacli chats list' as defined in SKILL.md. * Boundary markers: The skill provides textual 'Security Guardrails' in the instructions to resist adversarial framing, but does not use structural delimiters for external content. * Capability inventory: The agent has the ability to send messages ('wacli send') and access the local file system (SKILL.md). * Sanitization: No programmatic sanitization or filtering of retrieved message content is documented.
Audit Metadata