whapi
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is purely instructional and follows security best practices, such as providing warnings for destructive configuration changes.
- [INDIRECT_PROMPT_INJECTION]: The skill describes building bots that process untrusted WhatsApp message data. This surface is inherent to the skill's primary purpose. Ingestion points: Incoming webhook payloads containing message text as described in
recv-webhooks.mdandpattern-bot.md. Boundary markers: No explicit delimiters are used in the provided JSON/Python examples. Capability inventory: Extensive messaging, media, and group management capabilities via thewhapi-mcptoolset. Sanitization: The guide focuses on API usage and does not explicitly demonstrate input sanitization for the message body. - [EXTERNAL_DOWNLOADS]: Mentions official vendor tools (
whapi-mcpnpm package) and reputable services for local development and tunneling (ngrok, localtunnel, Cloudflare Tunnel), all of which are recognized safe sources. - [COMMAND_EXECUTION]: Provides standard documentation for running the WHAPI MCP server using
npx, which is intended for the developer's local environment setup.
Audit Metadata