whatsapp-cloud-api
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process incoming WhatsApp messages which originate from untrusted external users. The documentation (e.g., in
references/automation-patterns.md) suggests passing these messages to an LLM for automated responses. This creates a surface where a malicious user could send a message containing instructions to override the agent's behavior. - Ingestion points: Incoming messages are received via a Webhook POST endpoint, as seen in the boilerplate implementations in
assets/boilerplate/python/app.pyandassets/boilerplate/nodejs/src/index.ts. - Boundary markers: The provided code samples for AI integration (in
references/automation-patterns.md) show the user's message being interpolated into a prompt with a system message but without robust delimiters or explicit warnings to ignore embedded instructions. - Capability inventory: The skill provides tools for the agent to send text and interactive messages back to WhatsApp users, mark messages as read, and manage message templates via Meta's Graph API.
- Sanitization: While the skill implements HMAC signature validation to verify the sender is Meta (a security best practice), it does not include logic to sanitize or filter the content of the messages themselves for malicious instructions before processing.
Audit Metadata