WhatsApp Contacts

List, search, and lookup WhatsApp contacts from the Baileys session cache

This skill appears to do what it says: read a local Baileys session cache and list/search contacts. Before installing, consider: (1) the script needs read access to your OpenClaw state directory (default ~/.openclaw/credentials/whatsapp/default) which may contain sensitive WhatsApp session data — only install if you trust the skill and the environment; (2) the code is bundled with the skill (inspect it yourself); it currently only outputs contact info as JSON, but a modified version could exfiltrate data, so avoid giving the agent broad network/file privileges if you don't trust the source; (3) if you prefer narrower scope, run the script locally yourself instead of allowing autonomous agent invocation.

Type: OpenClaw Skill Name: whatsapp-contacts Version: 1.0.0 The skill is classified as suspicious due to its direct access to sensitive local files containing WhatsApp session and contact data. The `scripts/contacts.js` file reads from `process.env.OPENCLAW_STATE_DIR/credentials/whatsapp/default/store.json` or `contacts.json`. While this behavior aligns with the skill's stated purpose of listing and searching WhatsApp contacts, accessing such sensitive local credential/session stores represents a significant high-risk capability. There is no evidence of data exfiltration, persistence, or other malicious intent within the skill's code itself, but the exposure of this sensitive data via `console.log` could be leveraged by a malicious agent prompt for unauthorized exfiltration.