WhatsApp cloud api reference

Use when implementing WhatsApp messaging via Meta Cloud API, or diagnosing failures like message not delivered, template rejected, webhook issues, phone not...

This appears to be a legitimate WhatsApp Cloud API reference, but the registry metadata is missing required environment variables that the examples clearly use. Before installing or enabling this skill: - Treat the examples as requiring secrets: WA_ACCESS_TOKEN (access token), WA_PHONE_NUMBER_ID (phone number id), and VERIFY_TOKEN (webhook verification token). Ask the author to declare these explicitly in requires.env/primaryEnv. - Do not paste real access tokens into public or shared prompts. Store tokens in a secure environment and use least privilege (narrow scopes, rotate tokens). - Verify the SKILL.md claim about a "permanent" System User token — prefer short-lived tokens or token rotation when possible. - Inspect the rest of the SKILL.md (it was truncated in your copy) to confirm there are no instructions to forward payloads to non-Meta endpoints or to exfiltrate message contents. - Because this is instruction-only, it won't install software, but the skill assumes your runtime will provide the environment variables and networking needed to call Meta APIs and serve a public HTTPS webhook. Ensure your hosting, TLS, and webhook handling meet Meta's security recommendations. If you want, provide the full (untruncated) SKILL.md or ask the skill author to update the metadata to list the required env vars — that would raise this assessment to benign if no other issues appear.

Type: OpenClaw Skill Name: whatsapp-cloud-api-reference Version: 1.0.0 The skill bundle provides comprehensive documentation and code examples for interacting with the Meta WhatsApp Cloud API. All API calls are directed to legitimate Meta endpoints (graph.facebook.com). The code snippets demonstrate standard practices for API integration, including accessing environment variables for API tokens and handling webhooks. The debugging scripts are designed to help users diagnose their own API setup, not to exfiltrate data to unauthorized parties. There is no evidence of prompt injection attempts against the AI agent, nor any malicious code designed for data exfiltration, persistence, or unauthorized remote control.