whapi
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses official documentation and resources from the vendor, Whapi-Cloud, including the 'whapi.readme.io' reference and 'panel.whapi.cloud' dashboard.
- [COMMAND_EXECUTION]: The instructions provide a standard method for setting up the vendor's official 'whapi-mcp' Model Context Protocol server using 'npx'.
- [PROMPT_INJECTION]: The skill documents how to build WhatsApp bots that process incoming messages via webhooks (e.g., in 'references/pattern-bot.md' and 'references/recv-webhooks.md'). This establishes an indirect prompt injection attack surface where untrusted user input could influence agent behavior. 1. Ingestion points: Webhook JSON payloads containing message body text. 2. Boundary markers: No delimiters or 'ignore' instructions are included in the provided code examples. 3. Capability inventory: Access to 165 MCP tools for messaging, group management, and channel administration. 4. Sanitization: No sanitization or validation of the external content is demonstrated in the instructional patterns.
Audit Metadata