The Agent Skills Directory

[DATA_EXFILTRATION]: Accesses sensitive WhatsApp session directories and credential files. Evidence: The script scripts/utils.js targets the path ~/.openclaw/credentials/whatsapp/default. The exportContacts function reads and prints PII from contacts.json, while cacheInfo exposes the file structure and metadata for session-critical files like creds.json and session state files.
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection via untrusted data ingestion. Evidence: The exportContacts function in scripts/utils.js reads contact names and notification strings from contacts.json. Ingestion points include the contacts.json file which contains data from external WhatsApp users. Boundary markers are absent in the script output. Capability inventory includes filesystem read access and script execution. No sanitization or validation is performed on contact names before they are output to the agent.
[COMMAND_EXECUTION]: The skill uses the agent's execution tool to run a local Node.js script with various arguments. Evidence: SKILL.md usage examples show the agent invoking node <skill_dir>/scripts/utils.js with parameters that influence script logic.

whatsapp-utils-hardened