add-whatsapp-cloud
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several shell commands to build, test, and manage services.
- In
SKILL.md, it runspnpm run buildandpnpm exec vitest run src/channels/whatsapp-cloud-registration.test.tsto validate the installation. - In
REMOVE.md, it usesrm -fto delete files and service management commands includinglaunchctl kickstart(macOS) andsystemctl --user restart(Linux) to apply configuration changes. - [EXTERNAL_DOWNLOADS]: The skill manages external dependencies through standard package managers.
- It installs the package
@chat-adapter/whatsapppinned to version4.29.0viapnpm. - It copies adapter source files from a git branch named
channelsusing thenc:copydirective. - [CREDENTIALS_UNSAFE]: The skill handles sensitive Meta API credentials by prompting the user for input.
- It collects
WHATSAPP_ACCESS_TOKEN,WHATSAPP_PHONE_NUMBER_ID,WHATSAPP_APP_SECRET, andWHATSAPP_VERIFY_TOKEN. - These secrets are stored locally in a
.envfile using thenc:env-setdirective, which is a standard practice for local development and containerized environments. No exfiltration to external domains was detected.
Audit Metadata