add-whatsapp-cloud

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes several shell commands to build, test, and manage services.
  • In SKILL.md, it runs pnpm run build and pnpm exec vitest run src/channels/whatsapp-cloud-registration.test.ts to validate the installation.
  • In REMOVE.md, it uses rm -f to delete files and service management commands including launchctl kickstart (macOS) and systemctl --user restart (Linux) to apply configuration changes.
  • [EXTERNAL_DOWNLOADS]: The skill manages external dependencies through standard package managers.
  • It installs the package @chat-adapter/whatsapp pinned to version 4.29.0 via pnpm.
  • It copies adapter source files from a git branch named channels using the nc:copy directive.
  • [CREDENTIALS_UNSAFE]: The skill handles sensitive Meta API credentials by prompting the user for input.
  • It collects WHATSAPP_ACCESS_TOKEN, WHATSAPP_PHONE_NUMBER_ID, WHATSAPP_APP_SECRET, and WHATSAPP_VERIFY_TOKEN.
  • These secrets are stored locally in a .env file using the nc:env-set directive, which is a standard practice for local development and containerized environments. No exfiltration to external domains was detected.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 03:10 AM
Security Audit — agent-trust-hub — add-whatsapp-cloud