whatsapp-chats-hardened
Fail
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: HIGHDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The script scripts/chats.js accesses highly sensitive WhatsApp session data stored in the ~/.openclaw/credentials/whatsapp/default directory. This path contains session tokens, encryption keys (sender-key-*), and contact databases. Access to these credential files represents a high risk of sensitive data exposure to the LLM environment.
- [COMMAND_EXECUTION]: The skill executes a Node.js script to interact with the local file system and perform data analysis, which involves shell execution for processing WhatsApp cache files.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from the WhatsApp cache (contact names and group titles) without sanitization. Evidence: 1. Ingestion points: scripts/chats.js reads filenames and the contacts.json file. 2. Boundary markers: No delimiters or ignore-instructions warnings are present in the script output. 3. Capability inventory: The skill enables shell-based Node.js execution through the agent. 4. Sanitization: No escaping or validation is performed on the contact or group names before they are returned as JSON results.
Recommendations
- AI detected serious security threats
Audit Metadata