WhatsApp Validate

Check if phone numbers exist in the local Baileys session cache

This skill reads your local OpenClaw WhatsApp credential directory (~/.openclaw/credentials/whatsapp/default or the directory set by OPENCLAW_STATE_DIR) and parses session/device files and contacts.json to determine which phone numbers are known. It does not perform network calls in the included code, but the registry/manifest/SKILL.md do not declare the config path or the fact it requires Node. Before installing: - If you plan to use it, verify you have Node and consider running the script manually in a safe environment first (e.g., a throwaway account or VM) to confirm behavior. - If you use the skill with a real WhatsApp account, be aware it reads your session/contacts data — only install if you trust the skill owner and accept local exposure of that data. - Ask the author to update the manifest/SKILL.md to declare required binaries (node) and the exact config path(s) this skill reads (or allow overriding with OPENCLAW_STATE_DIR), and to document privacy considerations. - If you are uncomfortable, do not install or run it against a production account; run it in an isolated environment or inspect/modify the script to limit file reads to a safe test directory.

Type: OpenClaw Skill Name: whatsapp-validate Version: 1.0.0 The skill's purpose is to validate phone numbers against a local WhatsApp (Baileys) session cache. The `scripts/validate.js` file accesses the `OPENCLAW_STATE_DIR/credentials/whatsapp/default` directory, which is a sensitive location, but this access is directly aligned with the skill's stated purpose of querying Baileys session data. The script specifically extracts phone numbers from session filenames and a `contacts.json` file, not attempting to exfiltrate actual credential tokens or other unrelated sensitive data. Furthermore, the script includes robust input sanitization (`replace(/\D/g, '')`) for phone numbers, mitigating potential command injection vulnerabilities within the Node.js script itself. The `SKILL.md` provides standard usage instructions without any malicious prompt injection attempts.