WhatsApp Image Send

Send images, videos, audio, or documents via WhatsApp by downloading, copying to workspace, sending, and cleaning up temporary files.

Before installing or using this skill, consider: (1) The SKILL.md assumes a 'message' command is available but doesn't declare it—confirm which binary implements WhatsApp sending and that it's trusted. (2) The file paths are inconsistent: replace the hardcoded /home/seekey path with $HOME or ~ so it works for your account. (3) The skill downloads arbitrary URLs—only supply trusted URLs and ensure filenames are sanitized to avoid shell injection or path traversal. (4) Validate file types before sending and verify the workspace path is correct and writable. (5) Because this skill runs external network downloads, avoid using it with sensitive credentials or private files unless you trust the source. If you plan to use it, update the SKILL.md to remove hardcoded paths, declare required binaries, and add validation/safety steps.

Type: OpenClaw Skill Name: whatsapp-image-send Version: 1.0.1 The skill is suspicious due to its use of `curl -o /tmp/<filename> <url>` in `SKILL.md`. This command allows the agent to download arbitrary content from any user-provided URL, which is a critical vulnerability. An attacker could exploit this to make the agent download malicious payloads, potentially leading to further compromise, even though the skill's stated purpose is benign. There is no clear evidence of intentional malicious behavior like data exfiltration or backdoor installation, but the capability to fetch arbitrary remote files poses a significant risk.