WhatsApp Business Automation by WhatsAble

Full three-phase agent skills suite for Notifyer by WhatsAble. Phase 1 (setup-notifyer): account signup, login, WhatsApp connection status, subscription plan...

What to check before installing or running this skill: - Confirm provenance: SKILL.md and clawhub.json reference a GitHub repo and api.insightssystem.com, but the registry metadata you were shown listed no homepage/source. Locate and inspect the upstream GitHub repository (https://github.com/Whatsable/whatsapp-business-agent-skills) and ensure it is the official source and has recent, sensible commits. - Inspect code before execution: the package bundles many Node.js scripts. Open and review scripts/lib/notifyer-api.js and any code that calls loadConfig/requestJson to ensure they only read the documented env vars and do not read unrelated files (e.g., ~/.ssh, ~/.bash_history) or attempt to exfiltrate data to unexpected domains. - Validate environment requirements: the SKILL.md requires NOTIFYER_API_BASE_URL (must be https://api.insightssystem.com per docs) and NOTIFYER_API_TOKEN (JWT). The registry metadata omitted these — do not trust the registry omission. Only provide the token if you trust the code and service. Prefer creating a scoped/test account/token when possible. - Search SKILL.md for prompt-injection content: because a 'system-prompt-override' pattern was flagged, remove or ignore any instructions in SKILL.md that try to alter agent/system prompts or tell the agent to ignore earlier instructions. - Least privilege & isolation: run scripts in an isolated environment (throwaway account, container, or VM) first. Do not export production-wide tokens into global shell startup files until you confirm behavior. - Developer API key caution: get-api-key.js can retrieve a developer API key for integrations — treat that key like any secret. If a script outputs or persists that key, ensure it is stored securely and not uploaded to third-party services. - If you need help: ask for a focused code review of specific files (e.g., notifyer-api.js, login.js, get-api-key.js) if you are not comfortable reading the code yourself. Bottom line: the code appears functionally consistent with a Notifyer integration, but the metadata inconsistencies and the prompt-injection signal make this package suspicious until you verify the upstream repository and review the SKILL.md and the key library files.

Type: OpenClaw Skill Name: whatsapp-business-automation-by-whatsable Version: 1.0.2 The skill bundle is a comprehensive and well-documented suite of Node.js scripts for managing the Notifyer WhatsApp Business platform. It follows security best practices by using only built-in modules (zero dependencies), enforcing HTTPS to prevent token leakage, and providing explicit warnings about CLI credential visibility and backend API limitations. The scripts include proactive mitigations for backend vulnerabilities, such as ownership checks in delete-webhook.js, and the instructions in SKILL.md are strictly aligned with the stated purpose of workspace automation and chat operations without any harmful prompt-injection patterns.