WhatsApp FAQ Bot

Build and query a FAQ knowledge base from markdown files. Use when asked to create a FAQ bot, set up automatic answers, build a knowledge base, add FAQ entri...

This skill appears to do exactly what it says: build and search a local FAQ knowledge base from markdown. It does not contact external services or request credentials. Notes before installing: (1) Data is stored on disk by default at ~/.faq-bot (changeable with FAQ_BOT_DIR) — avoid storing sensitive secrets in FAQs or choose a protected directory. (2) The README/script mention an optional FAQ_BOT_DIR env var but the skill metadata lists no required env vars — this is harmless but a small mismatch to be aware of. (3) When integrating into an automated agent or cron job, ensure the agent runs in an environment with appropriate file permissions so your FAQ data isn't exposed. If you need the skill to access remote WhatsApp APIs or external services, those integrations are not present and would require additional secure credentials and review.

Type: OpenClaw Skill Name: whatsapp-faq-bot Version: 1.0.0 The `scripts/faqbot.py` file contains vulnerabilities related to file system access. The `import` command (`cmd_import`) allows reading arbitrary files from the filesystem (Local File Inclusion) by not validating the provided `filepath`. Similarly, the `export` command (`cmd_export`) allows writing the knowledge base content to arbitrary files (Local File Write) by not validating the `output` path. These flaws could be exploited by an attacker controlling the arguments passed to the script (e.g., via prompt injection against the OpenClaw agent) to read sensitive files or create/overwrite files in arbitrary locations, potentially leading to information disclosure or remote code execution, but there is no evidence of intentional malicious behavior within the script itself.