The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/start.sh contains a command that fetches an installation script from https://raw.githubusercontent.com/lncitador/whatsapp-mcp/main/install.sh and pipes it directly into the shell (sh). This method of executing remote scripts is a significant security risk as it bypasses verification and security controls.
[EXTERNAL_DOWNLOADS]: The skill requires downloading a binary and an installation script from an external repository (github.com/lncitador/whatsapp-mcp).
[COMMAND_EXECUTION]: The skill relies on the execution of the whatsapp-mcp binary for all its core functions, including starting, stopping, and checking the status of the daemon.
[DATA_EXFILTRATION]: The skill interacts with the ~/.whatsapp-mcp/ directory, which stores highly sensitive data such as session credentials, private messages, and media files. Accessing this data represents a risk of sensitive information exposure.
[PROMPT_INJECTION]: The skill presents external content (WhatsApp messages and status) to the agent, creating a surface for indirect prompt injection.
Ingestion points: WhatsApp messages, media files, and authentication status data processed by the whatsapp-mcp binary.
Boundary markers: None. No delimiters or safety instructions are used to wrap the untrusted data to prevent the agent from following embedded instructions.
Capability inventory: Execution of the whatsapp-mcp binary and the ability to download and execute remote shell scripts.
Sanitization: None. External content is not sanitized or filtered before being provided to the agent.

whatsapp