whatclaw-whatsapp-integration

Manages WhatsApp whitelists to send messages only to approved numbers, track delivery status, and verify OpenClaw connectivity via word-trigger commands.

This skill appears to do what it claims, but review and consider the following before installing or enabling autonomous use: - The script invokes your OpenClaw CLI to send messages; OpenClaw carries the actual network access and credentials. Ensure your OpenClaw login and channel permissions are appropriate. - Media may be a local file path. A user or an automated agent could issue a phrase that sends a local file (e.g., /etc/passwd) to numbers in a whitelist — treat this as a potential data-exfiltration vector inherent to any attachment-sending tool. Restrict who can invoke the skill and audit commands if confidentiality matters. - SKILL.md references a hard-coded user path (/home/vignesh/…). Update the working directory instructions to match your environment before running. - The skill stores persistent data under its data/ directory. Backups, access controls, or secure storage may be needed if the whitelist or message store contain sensitive info. If you want stronger assurance, run the script in an isolated environment (or sandbox) first, inspect the data files it creates, and verify OpenClaw CLI behavior and logs for any unexpected activity.

Type: OpenClaw Skill Name: whatclaw Version: 1.0.0 The skill provides a legitimate utility for managing WhatsApp whitelists and sending messages or media via the OpenClaw CLI. It uses safe command execution (execFile) to interact with the system and includes input validation for phone numbers and set names. While the script allows sending local files as media, this is a documented feature aligned with its stated purpose and does not exhibit signs of malicious intent, automated exfiltration, or unauthorized access. The hardcoded paths in SKILL.md appear to be developer environment artifacts rather than malicious indicators.