test

Send WhatsApp messages to other people or search/sync WhatsApp history via the wacli CLI (not for normal user chats).

This skill appears to do what it says: it invokes the wacli CLI to authenticate, sync, search history, and send messages/files. Before installing or using it: - Verify the wacli project and Homebrew tap (steipete) are the official sources you expect (review the GitHub repo and tap) because 'go @latest' and third-party brew taps pull upstream code at install time. - Understand privacy implications: using this skill will access your WhatsApp session directory (~/.wacli), allow searching message history, and can upload local files specified by the agent. Only use it when the user explicitly requests messaging a third party. - Be cautious about automatic use: the SKILL.md sensibly requires explicit recipient and message confirmation; ensure the agent follows those safeguards before sending anything. - Note the metadata mismatch (registry owner/slug vs _meta.json). That suggests the package metadata/packaging may be inconsistent—if provenance matters to you, confirm the publisher before trusting it with your WhatsApp account.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill The skill bundle is suspicious due to the `wacli send file` command described in `SKILL.md`. This command allows the agent to read arbitrary local files and send them via WhatsApp, posing a significant data exfiltration risk if the agent is compromised via prompt injection to target sensitive files (e.g., `~/.ssh/id_rsa`, `~/.aws/credentials`). While the instructions themselves include safety measures, the underlying capability is high-risk. Additionally, the installation instructions for `wacli` involve fetching from external sources (`github.com/steipete/wacli`), introducing a supply chain risk.