whatsapp-cloud-api
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill integrates with the official WhatsApp Business Cloud API (Meta). All network requests are directed to legitimate Facebook/Meta domains such as graph.facebook.com and business.facebook.com.
- [SAFE]: The provided boilerplates (Node.js/Express and Python/Flask) implement robust security for webhooks. Specifically, they use HMAC-SHA256 validation with constant-time string comparisons (crypto.timingSafeEqual and hmac.compare_digest) to verify the authenticity of incoming requests from Meta and prevent timing attacks.
- [SAFE]: Secret management follows best practices by using environment variables (facilitated by dotenv and python-dotenv) instead of hardcoding sensitive credentials like API tokens or app secrets.
- [SAFE]: The included utility scripts for project setup (scripts/setup_project.py), configuration validation (scripts/validate_config.py), and testing (scripts/send_test_message.py) perform legitimate tasks. The setup script includes path validation to ensure it doesn't operate within the skill's own source directory.
- [SAFE]: Dependencies listed in package.json and requirements.txt are well-known, industry-standard packages (e.g., axios, express, flask, httpx).
Audit Metadata