israeli-whatsapp-business
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONTIME_DELAYED_CONDITIONAL
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's Python script utilizes the
requestslibrary to interact with the Meta Graph API (graph.facebook.com). Per security guidelines, this is categorized as a well-known and trusted service. - [COMMAND_EXECUTION]: The provided Python script (
scripts/send_whatsapp.py) executes network operations using therequestslibrary to send messages and verify account status. These operations are essential to the skill's primary function. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection. It ingests untrusted data from user inputs (via CLI arguments for message bodies and template parameters) and is designed to handle external data via webhooks. While the skill includes validation for phone numbers, it does not explicitly sanitize the text content before sending it through the WhatsApp API.
- [TIME_DELAYED_CONDITIONAL]: The script implements logic (
is_valid_sending_time) that prevents message dispatch during Shabbat and outside Israeli business hours. This is a legitimate functional requirement for compliance and cultural norms in the target market and does not represent a malicious trigger.
Audit Metadata