WhatsApp Forward

Generate VCards, parse invite links, and create forwarding templates

This skill is a small local utility that runs a provided Node.js script to generate vCards, parse WhatsApp invite links, and show message templates. Before installing, ensure you are comfortable allowing the agent to run 'node' commands (Node.js must be available). The code contains no network calls or secret access, so it won't exfiltrate data or require credentials. If you want additional assurance, open scripts/forward.js yourself to review — it's short and human-readable.

Type: OpenClaw Skill Name: whatsapp-forward Version: 1.0.0 The skill is classified as suspicious due to a potential shell injection vulnerability. The `SKILL.md` file instructs the OpenClaw agent to execute `scripts/forward.js` with user-controlled arguments (e.g., contact names, phone numbers, JSON strings, URLs). If the agent does not properly sanitize or escape these arguments before constructing the command string for `exec`, an attacker could inject arbitrary shell commands. The `scripts/forward.js` file itself does not contain malicious logic, but its direct use of `process.argv` for arguments creates a common vector for shell injection if the calling environment (the OpenClaw agent) is not robustly secured against such input.