WhatsApp Group Admin

Group administration utilities - info, stats, invite link parsing, and creation templates

This skill appears to do what it says (count group members, parse invite links, create templates) but it reads local OpenClaw/WhatsApp state files (sender-key-* files and contacts.json) which may include sensitive contact or group metadata. Before installing: (1) confirm you are comfortable granting the skill read access to ~/.openclaw/credentials/whatsapp/default (or set OPENCLAW_STATE_DIR to a safe path); (2) note the skill assumes node is available — the package metadata does not declare this requirement; (3) inspect the included scripts/admin.js yourself (it is short and readable) or run it in a sandbox to verify behavior; (4) if you do not want any skill to access local WhatsApp state, do not install or disable autonomous invocation for this skill; (5) ask the author/registry to update metadata to list required binary 'node' and to declare the config path(s) it reads so users can make an informed decision.

Type: OpenClaw Skill Name: whatsapp-group-admin Version: 1.0.0 The skill is classified as suspicious due to two main factors: 1) The `SKILL.md` instructs the agent to execute a Node.js script (`scripts/admin.js`) with user-provided arguments directly, which is a common pattern that can lead to shell injection vulnerabilities if the script does not adequately sanitize input. 2) The `scripts/admin.js` file accesses sensitive local files within the OpenClaw agent's credential directory (`OPENCLAW_STATE_DIR/credentials/whatsapp/default`), specifically `contacts.json` and `sender-key-*` files, to extract WhatsApp group and member information. While this file access is plausibly needed for the skill's stated purpose of WhatsApp group administration, it involves handling sensitive data locally, increasing the risk profile.