The Agent Skills Directory

[DATA_EXFILTRATION]: The Node.js script scripts/common.js reads sensitive WhatsApp credentials and session identifiers (sender-key-*) from the ~/.openclaw directory. Accessing these files allows for the extraction of private communication metadata, group identities, and potentially cryptographic keys without explicit authorization beyond the skill's execution.
[COMMAND_EXECUTION]: The skill uses the exec tool to run local scripts with parameters derived from user input. While phone numbers are cleaned of non-digits, other arguments like group IDs are passed to file system search operations without robust sanitization, posing a risk of path traversal or unintended file access within the credential directory.
[PROMPT_INJECTION]: The SKILL.md and SAFETY.md files include prescriptive instructions ("guardrails") designed to override agent behavior. These instructions use imperative language to enforce specific operational boundaries regarding privacy and urgency, which serves as a method of behavior-shaping through injected metadata.
[DATA_EXFILTRATION]: The all-members command in the provided script enables the aggregation of all contacts and their connectivity patterns across all accessible groups. This capability facilitates the construction of a comprehensive social graph from private session data, which can then be displayed or exfiltrated by the agent.
[PROMPT_INJECTION]: The skill presents an Indirect Prompt Injection surface.
Ingestion points: scripts/common.js reads filenames and JSON content from the sensitive ~/.openclaw/credentials path.
Boundary markers: No delimiters or sanitization are applied to the data read from the filesystem before it is returned to the agent context.
Capability inventory: The skill possesses filesystem read capabilities via fs.readdirSync and fs.readFileSync, and CLI execution via the exec tool.
Sanitization: Input sanitization is limited to phone numbers, leaving other inputs and all ingested file data unvalidated.

whatsapp-common-groups-hardened