The Agent Skills Directory

[SAFE]: The skill is a legitimate tool for WhatsApp API integration and follows industry security standards.\n
Secure Webhook Implementation: The provided boilerplate code in assets/boilerplate/nodejs/src/webhook-handler.ts and assets/boilerplate/python/webhook_handler.py includes robust validation of incoming webhook signatures using the X-Hub-Signature-256 header and timing-safe equality checks (crypto.timingSafeEqual and hmac.compare_digest).\n
Environment Variable Management: The skill correctly guides users to manage sensitive credentials (tokens, secrets) via .env files rather than hardcoding them in the source code.\n
Project Setup Safety: The scripts/setup_project.py script includes path validation logic to prevent accidental modification of the skill's own source files.\n- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves receiving and processing external data from the WhatsApp platform, which introduces a potential attack surface for indirect prompt injection.\n
Ingestion points: Incoming messages and status updates are received via POST requests to the /webhook endpoint in assets/boilerplate/python/app.py and assets/boilerplate/nodejs/src/index.ts.\n
Boundary markers: The implementation logic separates message processing into discrete types (text, interactive, media), reducing the risk of instructions in user content being misinterpreted as commands.\n
Capability inventory: The skill has the capability to interact with the Graph API to send messages, react to messages, and update statuses across multiple scripts (whatsapp_client.py, whatsapp-client.ts).\n
Sanitization: Authentication and integrity are maintained through HMAC-SHA256 signature validation, ensuring that data is only processed from verified Meta servers.

whatsapp-cloud-api