whatsapp-alt
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The documentation includes
curlexamples for interacting with the vendor's REST API atapi.zavu.dev. These are standard integration examples for the service. - [EXTERNAL_DOWNLOADS]: References the official vendor SDK (
@zavudev/sdk) for Node.js integrations. This is a legitimate dependency for the described functionality. - [PROMPT_INJECTION]: The skill facilitates the processing of inbound WhatsApp messages through webhooks (
message.inbound). This constitutes a surface for indirect prompt injection, as the content of incoming messages is untrusted. Developers should implement proper boundary markers and sanitization when processing message text in an agent context.
Audit Metadata